Edit tour

Windows Analysis Report
billys.exe

Overview

General Information

Sample name:	billys.exe
Analysis ID:	1578540
MD5:	41f92168b17f6f6e3f0c2dd847b8790c
SHA1:	d72086c8d7cf22ee4a212a8aafbf2c1cfbb68db4
SHA256:	4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc
Tags:	exeuser-aachum
Infos:

Detection

Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

billys.exe (PID: 2556 cmdline: "C:\Users\user\Desktop\billys.exe" MD5: 41F92168B17F6F6E3F0C2DD847B8790C)

cmd.exe (PID: 4308 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4592 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "Student", "self_destruct": true, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 3145728}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: billys.exe PID: 2556	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.billys.exe.137c1520000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.billys.exe.137c1520000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\billys.exe", ParentImage: C:\Users\user\Desktop\billys.exe, ParentProcessId: 2556, ParentProcessName: billys.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe", ProcessId: 4308, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T21:35:12.549574+0100	2049441	1	A Network Trojan was detected	192.168.2.5	49704	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T21:35:12.549574+0100	2050806	1	A Network Trojan was detected	192.168.2.5	49704	45.130.145.152	15666	TCP
2024-12-19T21:35:12.750012+0100	2050806	1	A Network Trojan was detected	192.168.2.5	49704	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T21:35:12.549574+0100	2050807	1	A Network Trojan was detected	192.168.2.5	49704	45.130.145.152	15666	TCP
2024-12-19T21:35:12.750012+0100	2050807	1	A Network Trojan was detected	192.168.2.5	49704	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.billys.exe.137c1520000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "Student", "self_destruct": true, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 3145728}

Multi AV Scanner detection for submitted file

Source: billys.exe

ReversingLabs: Detection: 30%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1594DB0 CryptUnprotectData,LocalFree,	0_2_00000137C1594DB0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15950D0 CryptProtectData,LocalFree,	0_2_00000137C15950D0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1558910 CryptUnprotectData,LocalFree,	0_2_00000137C1558910

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: billys.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1557AA0 FindFirstFileW,FindNextFileW,	0_2_00000137C1557AA0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C160B5E0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00000137C160B5E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C160B530 FindClose,FindFirstFileExW,GetLastError,	0_2_00000137C160B530
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C16320F8 FindFirstFileW,	0_2_00000137C16320F8

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A4A60 GetLogicalDriveStringsW,

0_2_00000137C15A4A60

Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.5:49704 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.5:49704 -> 45.130.145.152:15666

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.5:49704 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A2890 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

0_2_00000137C15A2890

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: billys.exe, 00000000.00000002.2299888355.00000137BFA96000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: https://api.ipify.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A31C0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_00000137C15A31C0

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: billys.exe

Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A7C90 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_00000137C15A7C90
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A8390 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_00000137C15A8390
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1632718 NtQuerySystemInformation,	0_2_00000137C1632718
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1632728 NtAllocateVirtualMemory,	0_2_00000137C1632728

Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15EDBC0	0_2_00000137C15EDBC0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1551B70	0_2_00000137C1551B70
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1557AA0	0_2_00000137C1557AA0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A4D10	0_2_00000137C15A4D10
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A3EC0	0_2_00000137C15A3EC0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1599F00	0_2_00000137C1599F00
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A31C0	0_2_00000137C15A31C0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E3180	0_2_00000137C15E3180
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C155E240	0_2_00000137C155E240
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1584200	0_2_00000137C1584200
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1565430	0_2_00000137C1565430
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C157D2B0	0_2_00000137C157D2B0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1552260	0_2_00000137C1552260
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1612268	0_2_00000137C1612268
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C155F2E0	0_2_00000137C155F2E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15CA588	0_2_00000137C15CA588
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C159C5E0	0_2_00000137C159C5E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C160B5E0	0_2_00000137C160B5E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A56A0	0_2_00000137C15A56A0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15996D0	0_2_00000137C15996D0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C155D6E0	0_2_00000137C155D6E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15AC9C0	0_2_00000137C15AC9C0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1554A50	0_2_00000137C1554A50
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A2890	0_2_00000137C15A2890
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E4890	0_2_00000137C15E4890
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C155F890	0_2_00000137C155F890
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A3BA0	0_2_00000137C15A3BA0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1611BCC	0_2_00000137C1611BCC
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E1BC0	0_2_00000137C15E1BC0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15EAB70	0_2_00000137C15EAB70
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1558B60	0_2_00000137C1558B60
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E6C00	0_2_00000137C15E6C00
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B8ABC	0_2_00000137C15B8ABC
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15EFB20	0_2_00000137C15EFB20
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158FB50	0_2_00000137C158FB50
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15C8B08	0_2_00000137C15C8B08
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C156DDA0	0_2_00000137C156DDA0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1525DC0	0_2_00000137C1525DC0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15CBE30	0_2_00000137C15CBE30
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15CADF4	0_2_00000137C15CADF4
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B6DF0	0_2_00000137C15B6DF0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158BE16	0_2_00000137C158BE16
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1592CB0	0_2_00000137C1592CB0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B8CC0	0_2_00000137C15B8CC0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15C1CB8	0_2_00000137C15C1CB8
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1552C90	0_2_00000137C1552C90
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15EBC80	0_2_00000137C15EBC80
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1572F80	0_2_00000137C1572F80
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E2000	0_2_00000137C15E2000
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1528000	0_2_00000137C1528000
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B4EC0	0_2_00000137C15B4EC0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B8EC4	0_2_00000137C15B8EC4
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158FE70	0_2_00000137C158FE70
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1570E80	0_2_00000137C1570E80
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1591F40	0_2_00000137C1591F40
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15901A0	0_2_00000137C15901A0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158F200	0_2_00000137C158F200
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1571070	0_2_00000137C1571070
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15AC090	0_2_00000137C15AC090
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1578150	0_2_00000137C1578150
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15930F0	0_2_00000137C15930F0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A8390	0_2_00000137C15A8390
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15BF384	0_2_00000137C15BF384
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15982D0	0_2_00000137C15982D0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15792D0	0_2_00000137C15792D0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15BF268	0_2_00000137C15BF268
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15D32E0	0_2_00000137C15D32E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C155A5AD	0_2_00000137C155A5AD
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15935A6	0_2_00000137C15935A6
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15875D0	0_2_00000137C15875D0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C156F570	0_2_00000137C156F570
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C160E4B0	0_2_00000137C160E4B0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1527460	0_2_00000137C1527460
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E4530	0_2_00000137C15E4530
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15FB540	0_2_00000137C15FB540
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158F500	0_2_00000137C158F500
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15EE500	0_2_00000137C15EE500
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1595760	0_2_00000137C1595760
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158F830	0_2_00000137C158F830
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15FA820	0_2_00000137C15FA820
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15FA840	0_2_00000137C15FA840
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15477F0	0_2_00000137C15477F0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15BD7E0	0_2_00000137C15BD7E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C158B810	0_2_00000137C158B810
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15BB810	0_2_00000137C15BB810
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15CA804	0_2_00000137C15CA804
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1546800	0_2_00000137C1546800
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15496B0	0_2_00000137C15496B0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C157C6B0	0_2_00000137C157C6B0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15A86E0	0_2_00000137C15A86E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B49B4	0_2_00000137C15B49B4
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15999C3	0_2_00000137C15999C3
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15E89E0	0_2_00000137C15E89E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C159B8B0	0_2_00000137C159B8B0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1552890	0_2_00000137C1552890
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15278F0	0_2_00000137C15278F0

Source: C:\Users\user\Desktop\billys.exe	Code function: String function: 00000137C154E1B0 appears 32 times
Source: C:\Users\user\Desktop\billys.exe	Code function: String function: 00000137C1550910 appears 31 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@1/2

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A9910 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

0_2_00000137C15A9910

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C155F2E0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00000137C155F2E0

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C1591F40 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

0_2_00000137C1591F40

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Users\user\Desktop\billys.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69634FFDD2C9

Source: billys.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\billys.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: billys.exe

ReversingLabs: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\billys.exe "C:\Users\user\Desktop\billys.exe"
Source: C:\Users\user\Desktop\billys.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\billys.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\billys.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: billys.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: billys.exe

Static file information: File size 2749952 > 1048576

Source: billys.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x24bc00

Source: billys.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: billys.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: billys.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: billys.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: billys.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: billys.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: billys.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: billys.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: billys.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: billys.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: billys.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: billys.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: billys.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C155E240 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00000137C155E240

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C158B0F9 push rcx; iretd

0_2_00000137C158B0FC

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15996D0 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_00000137C15996D0

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\billys.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe"
Source: C:\Users\user\Desktop\billys.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe"			Jump to behavior

Source: C:\Users\user\Desktop\billys.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-53079

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1557AA0 FindFirstFileW,FindNextFileW,	0_2_00000137C1557AA0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C160B5E0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00000137C160B5E0
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C160B530 FindClose,FindFirstFileExW,GetLastError,	0_2_00000137C160B530
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C16320F8 FindFirstFileW,	0_2_00000137C16320F8

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A4A60 GetLogicalDriveStringsW,

0_2_00000137C15A4A60

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15E83D0 GetSystemInfo,LoadLibraryA,GetProcAddress,GetCurrentProcess,VirtualAlloc2,

0_2_00000137C15E83D0

Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: billys.exe, 00000000.00000002.2302436406.00000137C2540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: billys.exe, 00000000.00000002.2300163156.00000137BFAC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: billys.exe, 00000000.00000002.2302645419.00000137C30E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}//
Source: billys.exe, 00000000.00000002.2302436406.00000137C2550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}ZE
Source: billys.exe, 00000000.00000002.2299888355.00000137BFA59000.00000004.00000020.00020000.00000000.sdmp, billys.exe, 00000000.00000002.2300163156.00000137BFAC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\billys.exe	API call chain: ExitProcess graph end node			graph_0-51253
Source: C:\Users\user\Desktop\billys.exe	API call chain: ExitProcess graph end node			graph_0-51259

Source: C:\Users\user\Desktop\billys.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A8390 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_00000137C15A8390

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C160DBBC GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000137C160DBBC

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C160DBBC GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000137C160DBBC

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C155E240 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00000137C155E240

Source: C:\Users\user\Desktop\billys.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C1632310 SetUnhandledExceptionFilter,		0_2_00000137C1632310
Source: C:\Users\user\Desktop\billys.exe	Code function: 0_2_00000137C15B38D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00000137C15B38D8

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15982D0 ShellExecuteW,

0_2_00000137C15982D0

Source: C:\Users\user\Desktop\billys.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\Desktop\billys.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00000137C15D0BB4
Source: C:\Users\user\Desktop\billys.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00000137C15D0D98
Source: C:\Users\user\Desktop\billys.exe	Code function: EnumSystemLocalesW,	0_2_00000137C15C4ED8
Source: C:\Users\user\Desktop\billys.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00000137C160B1A0
Source: C:\Users\user\Desktop\billys.exe	Code function: GetLocaleInfoW,RaiseException,GetModuleHandleExW,	0_2_00000137C16323D0
Source: C:\Users\user\Desktop\billys.exe	Code function: GetLocaleInfoW,	0_2_00000137C15C5418
Source: C:\Users\user\Desktop\billys.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00000137C15D0350
Source: C:\Users\user\Desktop\billys.exe	Code function: EnumSystemLocalesW,	0_2_00000137C15D077C
Source: C:\Users\user\Desktop\billys.exe	Code function: EnumSystemLocalesW,	0_2_00000137C15D06AC

Source: C:\Users\user\Desktop\billys.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C160DB94 GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,GetSystemTimeAsFileTime,

0_2_00000137C160DB94

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A37A0 GetUserNameW,

0_2_00000137C15A37A0

Source: C:\Users\user\Desktop\billys.exe

Code function: 0_2_00000137C15A4D10 GetTimeZoneInformation,GlobalMemoryStatusEx,wcsftime,GetModuleFileNameA,

0_2_00000137C15A4D10

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.billys.exe.137c1520000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.billys.exe.137c1520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: billys.exe PID: 2556, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: billys.exe, 00000000.00000002.2299370881.00000137BFA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: billys.exe, 00000000.00000002.2299370881.00000137BFA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: billys.exe, 00000000.00000002.2299370881.00000137BFA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty (Web)
Source: billys.exe, 00000000.00000002.2299370881.00000137BFA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: billys.exe, 00000000.00000002.2299370881.00000137BFA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: billys.exe, 00000000.00000002.2299370881.00000137BFA4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\billys.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\billys.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\billys.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.billys.exe.137c1520000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.billys.exe.137c1520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: billys.exe PID: 2556, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 File Deletion	NTDS	24 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	11 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
billys.exe	31%	ReversingLabs	Win64.Trojan.Generic

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578540
Start date and time:	2024-12-19 21:34:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	billys.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 81 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: billys.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.130.145.152	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	venomderek.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	DHL_231437894819.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	4089137200.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	104.26.12.205
	cali.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	SwJD3kiOwV.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	8dw8GAvqmM.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	UYJ0oreVew.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	L1SrJoDQvG.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	Ry6ot1YULB.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	Cc8zEnIDB2.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	wlEp68Few5.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	rJvOqHxkuI.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	194.87.47.113
CLOUDFLARENETUS	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	https://supercrete.lk/m/ms_doc.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Employee_Letter.PDFuJPefyDW1j.url	Get hash	malicious	Unknown	Browse	172.67.134.25
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	104.26.0.231
	bad.txt	Get hash	malicious	AsyncRAT	Browse	104.21.84.67
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	(Lhambright)VWAV.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://usps.com-dscd.top/mum	Get hash	malicious	Unknown	Browse	172.67.202.68
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	172.67.74.152
	2JSGOlbNym.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	QCTYoyX422.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.67.74.152
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.67.74.152
	F8HYX5HOgA.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.67.74.152

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.84674468132717
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrU4wUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFrIW1IrIW83Wy:P+pTpcU4nsTDAFSkIrxMVlmJHaVtr1eq
MD5:	38A6ED2824540859D2923148B0B1E0E1
SHA1:	3F99ADE9E9E545F56766083B437D956C4557D3A2
SHA-256:	CCB4CA9180D0A3BA685602EC69270BAD1C98D87C8D6D949AC4BE95FF719DA7B7
SHA-512:	C8B8BB9366862459513610A3E4EABA0DF37E1390ED47AAF92BBCB1375C92AFCA0E8A16423F953B53B25F4A533AFE569E0ACA77D2F57777D3BCAC44D15C70A7E7
Malicious:	false
Reputation:	low
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=136ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 136ms, Maximum = 136ms, Average = 136ms..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.788201341891361
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	billys.exe
File size:	2'749'952 bytes
MD5:	41f92168b17f6f6e3f0c2dd847b8790c
SHA1:	d72086c8d7cf22ee4a212a8aafbf2c1cfbb68db4
SHA256:	4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc
SHA512:	51993dd5aed96c4dc4863ad9126be8f8e651b363cde9042561fc9fa1c9f19febacc786c9dbde8c148cd6eaf28b536e3056582e5413e507f67d4981ddde8a001f
SSDEEP:	24576:V9L8hJZ4uB+Ch0lhSMXlnwgT59w2/rbS43qtrtgBGVb5Q:PL8hD4auX/weJBGs
TLSH:	07D50195B3A849F8E1668238C8E60A49E7737C5503915BCF03A487B62F736D35E3E352
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\7...V...V...V.......V.......V.......V......yV..S....V..S....V..S....V.. ....V..P...<V..S....V...V...V..S....V..S.a..V..S....V.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14003e230
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6762C4F4 [Wed Dec 18 12:49:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	259e8414ffd4b8ab603913db518e276c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FCD98807EFCh
dec eax
add esp, 28h
jmp 00007FCD9880736Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FCD98807502h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FCD98807505h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FCD988074FDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FCD98806F36h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000FE37h]
dec eax
mov ecx, ebx
call dword ptr [0000FE26h]
call dword ptr [0000FD90h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0000FE1Ch]
dec eax
mov dword ptr [esp+00h], ecx

Rich Headers

Programming Language:

[IMP] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x298c04	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a3000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x29e000	0x4038	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a4000	0xad0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x290d80	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x290c40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e000	0x438	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4cdc0	0x4ce00	f0c0ea36bf296498c8b89c1a1671ba6c	False	0.5267625762195122	data	6.539312086987541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4e000	0x24ba3a	0x24bc00	c6c7fbdf8f7bd3b3a6de1752a4eb2fcb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29a000	0x330c	0x1800	d1ebd331d3cf6c8adbb31602bd239ee4	False	0.1865234375	data	3.2382802275840623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x29e000	0x4038	0x4200	8411825e2467307cedb8b6c4f15d3cdf	False	0.47123579545454547	data	5.575992239724539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2a3000	0x1e0	0x200	fd7f3c77b3b8152760b71a549e0deae5	False	0.52734375	data	4.7113407225994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a4000	0xad0	0xc00	49c311309af6d41eb0a329b47e6c6fcc	False	0.4716796875	data	5.228340394510781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2a3060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	FreeEnvironmentStringsW, GetEnvironmentStringsW, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, FlushInstructionCache, VirtualQuery, WriteProcessMemory, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, GetModuleHandleA, MultiByteToWideChar, GetWindowsDirectoryW, ExitProcess, WideCharToMultiByte, GetLastError, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, CreateThread, ExitThread, FreeLibrary, FreeLibraryAndExitThread, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetCurrentThreadId, DeleteCriticalSection, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, HeapSize, GetProcessHeap, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, GetFileSizeEx, SetFilePointerEx, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, WriteConsoleW, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, WakeAllConditionVariable, QueryPerformanceCounter, LCMapStringEx, DecodePointer, InitializeCriticalSectionEx, GetFileInformationByHandleEx, FormatMessageA, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, Sleep, WaitForSingleObjectEx, GetExitCodeThread, LocalFree, GetLocaleInfoEx, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, AreFileApisANSI
USER32.dll	LoadAcceleratorsW, LoadAcceleratorsA
ADVAPI32.dll	GetTokenInformation, OpenProcessToken
OLEAUT32.dll	SysAllocString, SafeArrayPutElement, SafeArrayUnaccessData, SafeArrayCreate, SafeArrayCreateVector, SafeArrayAccessData, SysFreeString, SafeArrayDestroy
mscoree.dll	CLRCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T21:35:12.549574+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.5	49704	45.130.145.152	15666	TCP
2024-12-19T21:35:12.549574+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49704	45.130.145.152	15666	TCP
2024-12-19T21:35:12.549574+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49704	45.130.145.152	15666	TCP
2024-12-19T21:35:12.750012+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49704	45.130.145.152	15666	TCP
2024-12-19T21:35:12.750012+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49704	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 21:35:09.852169991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:09.971703053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:09.971868038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:10.182629108 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:10.182662964 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:10.182816029 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:10.187257051 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:10.187273026 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.411133051 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.411233902 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.497293949 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.497314930 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.497596979 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.497641087 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.498967886 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.543325901 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.853646994 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.853729010 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:11.853781939 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.853781939 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.854152918 CET	49705	443	192.168.2.5	172.67.74.152
Dec 19, 2024 21:35:11.854168892 CET	443	49705	172.67.74.152	192.168.2.5
Dec 19, 2024 21:35:12.549573898 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.749954939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.749972105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.749984026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750011921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.750051975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.750060081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750106096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.750179052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750189066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750235081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750236034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.750257015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750298023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.750315905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.750335932 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750345945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.750396967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.869616032 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869708061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869716883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869779110 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869806051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869853973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869857073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.869857073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.869857073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.869895935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.869904995 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.869947910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.870058060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.870106936 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.870135069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.870179892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.870198011 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.870249987 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.870285988 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.870341063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.870371103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.870420933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.914191008 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.914261103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.990170002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.990246058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.990263939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.990315914 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.990365028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.990427971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.990447998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.990497112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:12.990506887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:12.990552902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.033997059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.034203053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111164093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111179113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111238956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111268044 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111280918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111330986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111363888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111423969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111423969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111423969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111432076 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111442089 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111445904 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111470938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111484051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111486912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111500025 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111519098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111521959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111540079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111573935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111605883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111619949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111634016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111675978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111762047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111777067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111802101 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111814976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111818075 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111841917 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111869097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111922026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111947060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.111974955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111996889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.111999035 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.112018108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.112047911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.112062931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.112143040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.112157106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.112194061 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.112209082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.153819084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.153892040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.153942108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.153960943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232320070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232436895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232449055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232490063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232501984 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232516050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232522011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232522011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232532024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232541084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232553005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232574940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232603073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232634068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232647896 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232685089 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232714891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232742071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232754946 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232780933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232795000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232798100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232820034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232826948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232836008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232846975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232877016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232911110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.232943058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232955933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.232995033 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233009100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233012915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233042002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233062029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233095884 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233100891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233114004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233149052 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233165026 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233174086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233186960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233227015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233252048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233266115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233305931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233356953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233370066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233402967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233436108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.233468056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.233517885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.273705959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.273726940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.273740053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.273905039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.273905039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357213020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357225895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357244015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357271910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357307911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357320070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357350111 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357429981 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357481956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357481956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357551098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357563972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357587099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357597113 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357603073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357620955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357633114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357655048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357702971 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357739925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357747078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357764006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357780933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357785940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357795000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357808113 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357820988 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357831001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357841969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357877016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357898951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357912064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357934952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357947111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357947111 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.357955933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357980967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.357997894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358017921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358031034 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358059883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358073950 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358100891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358114958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358125925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358139038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358155966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358169079 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358184099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358191967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358234882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358364105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358383894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358397007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358412027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358419895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358424902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358433962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.358449936 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358460903 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.358493090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.393750906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.393846035 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.393866062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.393867016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.394093037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.483869076 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.483926058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.483937979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.483947039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.483998060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484004974 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484029055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484055042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484081030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484127998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484152079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484177113 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484191895 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484256029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484303951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484304905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484350920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484383106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484397888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484437943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484456062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484517097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484529972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484565973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484582901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484637022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484649897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484678984 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484683990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484694958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484720945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484728098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484771013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484833002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484846115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484879971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484894991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.484910011 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.484957933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485048056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485059977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485073090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485101938 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485119104 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485181093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485204935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485233068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485260010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485281944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485305071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485330105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485343933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485400915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485414028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485455990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485476017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485523939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485537052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485564947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485589027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485632896 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485646009 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485697031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485735893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485780001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485809088 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485852003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485882998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485894918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.485930920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.485975981 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.604552984 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.604561090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.604630947 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.604756117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.604756117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714158058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714288950 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714298964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714395046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714420080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714428902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714437962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714468956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714488029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714555979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714565039 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714612961 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714624882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714624882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714634895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714659929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714672089 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714687109 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714694023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714716911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714741945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714809895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714818954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714857101 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714886904 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714936972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714939117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.714946985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714983940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.714997053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715027094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715050936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715059042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715091944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715128899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715137959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715145111 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715152979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715184927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715203047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715318918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715328932 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715336084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715343952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715379000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715398073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715455055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715464115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715504885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715569019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715614080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715620995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715656042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715713024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715754986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715756893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715810061 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715815067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715859890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715861082 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715908051 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.715944052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715962887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.715980053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.716008902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.716008902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.716026068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.716079950 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.716125011 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.716134071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.716171980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.716187000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.716228962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.831306934 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.831408978 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.831439018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.831559896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.840967894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841012001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841068983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841099977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841130018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841156006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841156006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841156006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841213942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841217041 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841233969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841243029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841268063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841273069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841295958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841301918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841325045 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841355085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841356993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841384888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841413021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841415882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841442108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841448069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841459990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841491938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841506958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841521025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841548920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841552019 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841572046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841578007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841600895 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841607094 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841626883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841636896 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841655970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841665030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841686010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841694117 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841711998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841741085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841747999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841777086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841804028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841805935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841818094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841831923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841854095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841860056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841883898 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841887951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841916084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841916084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841939926 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841944933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841964006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841972113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.841991901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.841999054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842020035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842048883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842050076 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842078924 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842099905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842107058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842130899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842133999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842152119 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842161894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842184067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842211962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842220068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842241049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842261076 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842289925 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842291117 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842319965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842341900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842355967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842367887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842403889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842461109 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842510939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842514038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842540026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842556953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842592955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842628956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842678070 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.842680931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.842736959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.951617956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.951637030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.951653004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.951679945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.951709032 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.961992979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962059021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962105036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962147951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962197065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962239981 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962286949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962335110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962342024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962382078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962388992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962402105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962430000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962445974 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962507963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962522030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962547064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962552071 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962559938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962567091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962574959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962615013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962629080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962681055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962693930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962707043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962724924 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962737083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962745905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962760925 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962785959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962814093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962853909 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962914944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962928057 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.962958097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962973118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.962996960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963010073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963044882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963048935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963056087 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963062048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963088989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963113070 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963126898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963140011 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963166952 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963181973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963206053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963218927 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963252068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963363886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963376999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963388920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963403940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963408947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963438034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963459969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963464975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963478088 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963505983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963516951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963572025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963586092 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963624001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963634968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963637114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963666916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963675976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963689089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963694096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963721037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963730097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963785887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963808060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963820934 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963831902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963845968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963854074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963876009 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963886023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963896990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963907003 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.963936090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.963948011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.964015007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.964027882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.964040041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.964051962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.964057922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.964076042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.964097977 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.964117050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.964129925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:13.964159012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:13.964175940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.071321964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.071350098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.071367025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.071533918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.071533918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.081762075 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.081859112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.081866980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.081907034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.081933975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.081963062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.081984043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082016945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082158089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082186937 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082206011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082226992 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082258940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082288027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082309008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082334042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082339048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082366943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082384109 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082416058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082422972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082451105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082470894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082492113 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082500935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082530022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082547903 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082557917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082573891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082586050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082597971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082638979 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082638979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082669020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082686901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082716942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082717896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082748890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082760096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082793951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082798004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082825899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082842112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082859039 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082873106 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082906008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082927942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082954884 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.082973957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.082983971 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083003998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083029985 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083031893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083060026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083077908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083110094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083127022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083173990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083174944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083218098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083226919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083255053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083273888 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083302021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083345890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083374977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083391905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083420038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083427906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083456039 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083477020 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083489895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083504915 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083534956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083544016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083576918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083595991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083606005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083615065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083652020 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083655119 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083682060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083703041 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083714008 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083735943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083744049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083760023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083791971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083796024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083823919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083839893 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083870888 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083873987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083903074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083926916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083934069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.083949089 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083980083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.083983898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.084031105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.084050894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.084095955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.084125996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.084171057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.084203959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.084249973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.084254026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.084281921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.084291935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.084328890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.192250967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.192284107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.192307949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.192313910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.192342997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.192357063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.201626062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.201658010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.201674938 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.201695919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.201711893 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.201742887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.201772928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.201818943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.201863050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.201910973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.202384949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.202435970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.202584982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.202626944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.202802896 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.202855110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.203825951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.203883886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.204305887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.204366922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.205837965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.205897093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.206329107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.206377983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207376957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207427979 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207731009 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207762003 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207782984 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207791090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207812071 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207834005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207835913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207865953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207879066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207895994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207914114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207940102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.207948923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207978964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.207997084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208007097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208019018 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208034992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208051920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208064079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208082914 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208091021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208112955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208120108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208144903 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208148956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208173037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208177090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208184958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208206892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208221912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208235979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208251953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208265066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208281994 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208293915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208314896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208323002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208347082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208350897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208360910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208378077 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208393097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208408117 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208425045 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208436966 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208455086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208466053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208486080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208498955 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208518982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208528042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208551884 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208556890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208575964 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208585024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208599091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208612919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208631039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208645105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208657980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208683014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208693027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208713055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208729029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208741903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208759069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208770990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208786964 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208800077 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208817959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208827019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208842039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208854914 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208878040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208883047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208899975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208910942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208939075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208939075 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208955050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208967924 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.208993912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.208995104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.209005117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.209023952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.209042072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.209052086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.209069014 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.209079981 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.209100008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.209106922 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.209121943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.209156036 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.312015057 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.312047958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.312078953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.312083006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.312088966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.312124968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.321433067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.321463108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.321500063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.321516037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.321517944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.321544886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.321572065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.321578026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.321604967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.321631908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.322102070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.322151899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.322259903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.322314024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.322364092 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.322410107 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.323419094 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.323470116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.323964119 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.324018955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.324037075 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.324081898 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.325491905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.325541973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.325891972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.325937986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.326983929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.327034950 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.328593969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.328650951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.328694105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.328722954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.328741074 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.328771114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.328979015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329008102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329024076 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329039097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329058886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329080105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329090118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329121113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329135895 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329154015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329169035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329204082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329229116 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329258919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329272032 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329288006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329304934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329314947 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329334021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329359055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329365015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329385996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329405069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329415083 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329432964 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329447985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329463959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329493999 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329499960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329528093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329549074 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329557896 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329579115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329586029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329605103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329638004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329638958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329667091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329684973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329694986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329722881 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329724073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329735041 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329773903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329775095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329803944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329818964 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329834938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329854965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329863071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329879999 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329907894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329916000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329945087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329963923 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.329972982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.329992056 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330017090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330024958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330054045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330075026 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330100060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330104113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330132008 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330149889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330159903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330179930 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330193043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330209970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330240965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330243111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330269098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330290079 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330302954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330317020 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330351114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330353022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330396891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330435038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330485106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330487967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330538034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330571890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330600023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.330621958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.330645084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.434470892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.434701920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.445436954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.445651054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.445655107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.445743084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.448144913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.448209047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.448344946 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.448400021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.451061010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.451122046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.452400923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.452459097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.452498913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.452538967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.452569008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.452603102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.453963995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454021931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454036951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454066992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454091072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454117060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454119921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454145908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454173088 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454173088 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454200029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454220057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454281092 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454329967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454335928 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454358101 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454385996 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454385996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454412937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454433918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454438925 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454462051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454488039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454514027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454708099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454775095 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454776049 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454802990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454835892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454835892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454857111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454863071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.454891920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.454922915 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.455836058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.455889940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.455895901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.455951929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.455955029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.455982924 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.456012011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.456027985 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.554677010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.554757118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.565651894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.565696001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.565745115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.565756083 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.565783978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.565785885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.565809965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.565821886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.565840960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.565872908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.568152905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.568223000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.568228960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.568276882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.571114063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.571243048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.572350979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.572381020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.572406054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.572429895 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.572493076 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.572547913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.573913097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.573962927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574137926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574172974 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574187994 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574220896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574311018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574361086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574409962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574454069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574476004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574528933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574546099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574600935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574649096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574678898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574702024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574711084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574728012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574760914 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574765921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574799061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574814081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574846983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574873924 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574922085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.574965000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.574995041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575012922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575042963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575052023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575074911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575093031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575124025 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575164080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575211048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575364113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575392962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575414896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575442076 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575476885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575526953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575562954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575594902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575617075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575639963 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575764894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575793982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575820923 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575823069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.575846910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.575870991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.675121069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.675229073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.704916954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.705272913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.705354929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.705389023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.795176983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.795357943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.824951887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825089931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825148106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825165987 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825193882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825205088 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825239897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825253010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825337887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825376987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825423956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825592995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825618029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825649023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825669050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825721979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825781107 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825793028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825840950 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825850964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825901031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.825969934 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.825999975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826029062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826046944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826143980 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826196909 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826255083 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826309919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826309919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826360941 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826371908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826421976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826431990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826483965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826484919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826530933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826544046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826581001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826589108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826630116 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826643944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826679945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826719999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826767921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826776981 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826819897 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826827049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826885939 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826901913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826931000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.826951027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.826982021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827049971 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827101946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827106953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827131987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827152967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827183962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827265024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827325106 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827368021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827414989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827430010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827476025 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827480078 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827526093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827605963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827652931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827691078 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827734947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827764034 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827816010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827837944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827887058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.827888012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.827940941 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.915085077 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.915214062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.951978922 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952028990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952052116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952080965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952133894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952166080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952181101 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952214003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952271938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952322006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952322960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952348948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952370882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952394962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952414989 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952461958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952469110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952512026 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952553988 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952610016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952657938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952706099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952709913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952753067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952833891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952847958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.952884912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952903986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.952958107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953006983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953011036 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953054905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953113079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953160048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953200102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953272104 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953322887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953377008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953392982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953440905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953474045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953517914 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953778982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953804016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953819036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953828096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953851938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953860044 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953866005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.953875065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953898907 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953911066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.953963041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954005957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954030037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954044104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954077005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954097986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954140902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954190016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954220057 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954262972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954272985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954312086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954314947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954359055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954411983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954456091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954497099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954544067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954577923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954622030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954649925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954678059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954703093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954725027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954796076 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954842091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954862118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954900026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.954910040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954942942 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:14.954962969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:14.955004930 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.035010099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.035145044 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.076889038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.076975107 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077044964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077100992 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077116013 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077163935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077207088 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077258110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077290058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077305079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077336073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077353954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077404022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077457905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077555895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077601910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077678919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077728987 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077775002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077825069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077867031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077910900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077924013 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.077966928 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.077986956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078032970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078089952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078136921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078203917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078248978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078291893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078339100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078382969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078433037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078461885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078511953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078547001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078591108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078608036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078651905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078725100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078771114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078840017 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078855991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078886032 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078905106 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.078938007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.078982115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079087019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079133034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079178095 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079231977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079232931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079278946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079329014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079374075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079400063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079447985 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079513073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079528093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079560041 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079577923 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079636097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079682112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079721928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079781055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079840899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079885960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079889059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.079938889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.079974890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.080027103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.080070972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.080085039 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.080121040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.080138922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.080259085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.080308914 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.080380917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.080394030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.080432892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.080451012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.156739950 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.156956911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.196991920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197112083 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197113991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197156906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197189093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197294950 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197305918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197343111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197691917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197724104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197748899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197753906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197774887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197804928 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197807074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197837114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197861910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197864056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197889090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197896957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197918892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197925091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.197956085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197981119 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.197993994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198050022 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.198170900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198225021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.198551893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198580027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198606014 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.198609114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198640108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.198642015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198656082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.198695898 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.198710918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.198770046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199100018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199151993 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199153900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199182034 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199208975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199209929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199239016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199240923 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199258089 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199273109 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199290991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199342012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199347019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199377060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199402094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199404955 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199434042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199449062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199579954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199611902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199635029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199664116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199871063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199899912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199928999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199929953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199948072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.199959040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.199985981 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200007915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200011015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200057983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200068951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200087070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200113058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200136900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200541019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200570107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200597048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200598955 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200614929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200627089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200653076 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200656891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200679064 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200684071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.200711966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.200742006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.246318102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.246443033 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.276938915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.277045012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.316826105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.316903114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.316989899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317042112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317054987 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317099094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317178965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317234993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317285061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317342997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317363024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317419052 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317430019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317487001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317533970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.317593098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.317975998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318058968 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318065882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.318121910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.318233013 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318294048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.318351030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318403006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.318417072 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318474054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.318511009 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318542004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.318576097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.318588018 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319009066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319067001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319163084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319196939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319220066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319256067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319273949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319330931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319358110 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319411993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319433928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319468021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319502115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319514036 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319518089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319567919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319655895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319713116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319794893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319828033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319854975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319881916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319933891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.319992065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.319998026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320044041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320055962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320127010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320152998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320159912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320178032 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320215940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320240021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320290089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320297956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320322037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320343018 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320374012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320430040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320489883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320528030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320584059 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320614100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320668936 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320698023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320755005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320813894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320868015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.320883036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.320935011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.362176895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.362255096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.396787882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.396872997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.436759949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.436837912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437061071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437114954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437117100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437170982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437241077 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437302113 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437477112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437531948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437556028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437612057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437671900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437721014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437733889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437772036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437783957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437825918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.437884092 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.437937975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438024998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438081026 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438117981 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438163996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438172102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438216925 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438298941 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438354969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438364029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438416004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438462019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438523054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438524961 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438580990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438618898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438673973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438766956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438817024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.438901901 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.438958883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439040899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.439095020 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439189911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.439245939 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439352036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.439402103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439503908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.439560890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439620972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.439677954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439749956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.439805031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.439973116 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440035105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440042019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440094948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440174103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440229893 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440340996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440396070 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440500021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440560102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440566063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440619946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440655947 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440713882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440733910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440764904 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440790892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440820932 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440838099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440896988 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.440912962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.440963984 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441026926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441075087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441082001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441133976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441209078 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441266060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441292048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441345930 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441414118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441472054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441478014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441530943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441596031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441656113 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441668987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441723108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441752911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441812038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441854954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.441917896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.441962957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.442017078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.482017040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.482361078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.529592037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.529665947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.556726933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.556786060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.556852102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.556905031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.556921005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.556967974 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.556987047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557019949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557138920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557248116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557301998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557334900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557354927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557387114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557588100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557642937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557724953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557776928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557781935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557832956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557879925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.557930946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.557975054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558027029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558177948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558231115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558231115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558285952 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558334112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558383942 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558500051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558552980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558589935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558636904 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558689117 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558732986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558741093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558785915 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558799982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558845043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.558850050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558893919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.558953047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559017897 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559026957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559070110 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559075117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559122086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559290886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559350014 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559478045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559536934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559627056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559678078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559762001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559813023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559890985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559940100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.559954882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.559997082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560072899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560123920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560153008 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560199976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560209036 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560251951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560369015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560400963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560419083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560456991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560491085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560523033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560576916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560645103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560677052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560698032 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560730934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560765028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560822010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560887098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.560944080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.560990095 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561043978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561086893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561119080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561136007 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561168909 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561219931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561273098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561306000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561356068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561424971 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561454058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561472893 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561506033 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561564922 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561614990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.561630011 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.561686039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.602145910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.602272034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.602324009 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.602458000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.649916887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.650015116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.676647902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.676714897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.676748991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.676830053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.676860094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.676898003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677067995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677097082 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677124023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677129030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677143097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677181959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677284002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677339077 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677432060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677464962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677485943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677520990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677696943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677757978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677803993 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677839041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677859068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677890062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.677906990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.677983046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678174019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678234100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678235054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678267002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678286076 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678316116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678447008 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678493977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678498983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678538084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678550005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678594112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678637981 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678670883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678693056 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678719997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678767920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678796053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678821087 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678842068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.678843975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.678896904 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679193020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679241896 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679246902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679296970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679392099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679455996 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679523945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679577112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679594994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679652929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679657936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679712057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679745913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679805040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679861069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679893970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.679919004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.679943085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680030107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680082083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680128098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680237055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680243969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680294991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680375099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680422068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680429935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680474043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680520058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680568933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680572987 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680622101 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680634022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680660963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680684090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680695057 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680713892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680743933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680804968 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680856943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680886984 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.680941105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.680974960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681029081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.681051016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681103945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.681166887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681221008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.681231022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681282043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.681322098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681375027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.681432962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681489944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.681507111 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.681560040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.722002029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.722121954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.722142935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.722202063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.766294956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.766391993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.769958973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.770023108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.796703100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.796829939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.796844006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.796945095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797003031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797069073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797120094 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797173023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797187090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797239065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797342062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797390938 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797560930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797611952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797616005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797666073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797713041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797746897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797765017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797800064 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.797899961 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.797946930 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798006058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798055887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798093081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798141003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798244953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798297882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798301935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798352003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798357964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798409939 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798437119 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798491955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798540115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798572063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798589945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798624992 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798679113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798727989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798746109 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798796892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798823118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798867941 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.798872948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.798918962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799160004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799213886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799340010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799396038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799451113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799504042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799525023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799556971 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799573898 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799608946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799648046 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799694061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799698114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799743891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.799782991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.799835920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800069094 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800121069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800272942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800308943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800326109 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800353050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800363064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800415039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800441027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800489902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800637007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800688028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800769091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800800085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800821066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800852060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800867081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.800915956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.800968885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801023006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.801084995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801129103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.801182032 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801229954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.801254988 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801306963 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.801330090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801376104 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.801465988 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801532030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.801557064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.801608086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.841852903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.841949940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.841979980 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.842037916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.882162094 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.882230997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.889652014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.889720917 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.916666031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.916786909 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.916855097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.916915894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.916928053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.916960955 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.916981936 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917020082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917047024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917094946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917170048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917197943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917221069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917248011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917270899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917320967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917366982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917416096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917433023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917479992 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917521000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917570114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917655945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917701006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917706966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917753935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917812109 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917862892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917887926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917941093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.917960882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.917993069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918013096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918092966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918093920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918142080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918204069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918250084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918308973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918360949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918382883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918430090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918437004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918468952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918487072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918515921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918555975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918586969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918611050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918638945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918652058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918700933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.918832064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.918880939 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919133902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919190884 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919244051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919290066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919342041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919378042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919394970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919426918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919472933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919522047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919524908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919569969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919631958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919661999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919684887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919712067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919771910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919821978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.919898987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.919951916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920052052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920110941 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920145988 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920172930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920192957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920217037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920298100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920345068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920376062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920422077 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920444012 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920491934 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920494080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920520067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920540094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920562983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920629025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920676947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920783997 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920831919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.920883894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.920942068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.921067953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.921118021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.921181917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.921214104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.921236992 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.921258926 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.921320915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.921353102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.921370029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.921399117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.961606979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.961709976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:15.961786985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:15.961848021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.002314091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.002413988 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.009332895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.009390116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.036407948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.036551952 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.036801100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.036859989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.036931992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.036987066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.036998034 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037053108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037126064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037184954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037224054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037281990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037282944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037338972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037399054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037451982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037502050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037554979 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037616968 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037672997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037754059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037808895 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037856102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.037908077 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.037976980 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038038015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038096905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038147926 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038211107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038264990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038307905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038362980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038419962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038472891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038511992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038538933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038564920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038572073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038587093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038621902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038665056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038693905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038721085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038753986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038754940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038805008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038820982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038851976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.038872957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038901091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.038950920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039007902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039093971 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039149046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039203882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039237976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039259911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039294004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039302111 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039350986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039366961 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039421082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039449930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039496899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039500952 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039529085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039550066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039575100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039603949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039650917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039659023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039702892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039736986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039788961 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039853096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039885998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.039901972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039941072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.039949894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040002108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040025949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040080070 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040122986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040170908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040178061 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040224075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040268898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040323973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040332079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040359974 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040386915 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040416956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040421963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040453911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040477991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040505886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040517092 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040560007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040569067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040615082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040637970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040690899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040712118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040752888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040764093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040807962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040894985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040927887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.040951967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.040980101 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.041014910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.041047096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.041078091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.041095972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.041095972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.041148901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.041160107 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.041210890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.081485033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.081592083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.081604004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.081666946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.128950119 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.129065037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.156145096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.156359911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.156461954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.156516075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.156591892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.156645060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.156681061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.156729937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.156780958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.156831980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.156907082 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.156955004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157043934 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157089949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157115936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157166004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157166004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157196999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157219887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157247066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157318115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157370090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157413960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157459021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157463074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157521963 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157604933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157658100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157726049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157778025 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157797098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157830000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.157855988 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.157879114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158013105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158072948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158158064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158211946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158283949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158346891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158392906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158446074 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158467054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158519030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158560991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158616066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158660889 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158693075 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158714056 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158747911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158757925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158791065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158812046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158848047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158866882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158915043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158920050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.158960104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.158967018 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159009933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159286022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159343004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159374952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159431934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159440994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159507036 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159523010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159569979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159575939 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159624100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159672976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159727097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.159873962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.159926891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160006046 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160049915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160063982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160120964 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160267115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160295010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160321951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160342932 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160343885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160371065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160397053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160403967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160427094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160454988 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160468102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160500050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160518885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160554886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160572052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160620928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160628080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160670042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160686970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160737991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160744905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160769939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160798073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160826921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160837889 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160890102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160916090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.160967112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.160984039 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161036968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161087990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161115885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161140919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161169052 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161178112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161227942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161235094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161276102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161293983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161315918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161331892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161360025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161370993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161412001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.161426067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.161480904 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.201389074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.201503992 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.201554060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.201616049 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.249692917 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.249814987 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276313066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276451111 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276468039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276560068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276612997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276631117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276701927 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276767969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276874065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276904106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276933908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276938915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.276961088 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.276994944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277147055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277198076 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277210951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277230024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277257919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277282953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277309895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277365923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277367115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277420998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277448893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277498960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277498960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277553082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277565002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277611017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277815104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277864933 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.277896881 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.277951002 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278055906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278084040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278107882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278134108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278232098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278285027 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278345108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278398037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278528929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278588057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278644085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278698921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.278950930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.278980970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279009104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279014111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279031038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279061079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279063940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279089928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279110909 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279122114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279143095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279170990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279205084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279254913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279345036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279372931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279395103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279421091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279499054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279551029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279630899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279681921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.279751062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.279799938 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280004978 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280059099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280149937 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280199051 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280425072 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280477047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280632973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280684948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280719042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280752897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280769110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280802965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280817032 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280865908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.280956030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.280989885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281012058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281039953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281068087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281119108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281117916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281151056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281164885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281200886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281229973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281281948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281281948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281330109 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281358957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281387091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281407118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281435013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281462908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281491041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281518936 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281531096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281538963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281588078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281605005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281632900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281656981 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281666040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281682968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281718016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.281729937 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.281780005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.321810007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.321850061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.321878910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.321943045 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.321976900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.369797945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.370001078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.396883011 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.396924973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.396954060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.396969080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397010088 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397017002 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397037983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397039890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397063017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397089958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397149086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397205114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397258043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397317886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397351980 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397408962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397455931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397512913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397521973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397574902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397620916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397675991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397712946 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397762060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397764921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397814035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.397908926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.397968054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398051977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398113012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398154020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398206949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398328066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398396969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398421049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398471117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398473024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398530006 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398541927 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398575068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398595095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398622990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398765087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398829937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.398880005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.398932934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399022102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399075031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399100065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399154902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399209023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399262905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399346113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399405956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399419069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399477005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399492979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399547100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399588108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399640083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399679899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399715900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399739981 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399770021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399828911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399876118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.399878025 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399940968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.399969101 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400023937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400085926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400120020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400139093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400165081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400222063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400274038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400454998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400513887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400523901 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400579929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400623083 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400676012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400733948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400788069 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400813103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400866985 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.400943995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.400998116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401031017 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401082993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401276112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401330948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401359081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401415110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401456118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401510000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401524067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401578903 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401613951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401665926 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401766062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401794910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401823997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401844978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.401910067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.401966095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402019024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402069092 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402144909 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402200937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402267933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402302027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402321100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402349949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402360916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402415991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402457952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402509928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.402510881 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.402565956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.441891909 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.442008972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.489835024 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.489911079 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.530148983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.530392885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.530462980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.530524015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.530601025 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.530628920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.561717033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.561815023 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.561922073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.609579086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.609687090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650122881 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650190115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650300026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650362015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650473118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650525093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650538921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650577068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650590897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650636911 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650641918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650686979 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650702953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650752068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650768042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650816917 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.650909901 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650959015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.650979042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651020050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651200056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651249886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651268959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651282072 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651303053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651344061 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651381969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651433945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651433945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651484966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651510000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651540995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651571989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651585102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651617050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651689053 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651706934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651745081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651787996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651838064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.651849031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.651890993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652091980 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652136087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652153969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652194023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652218103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652246952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652281046 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652297020 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652375937 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652435064 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652484894 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652539015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652539015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652599096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652604103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652642012 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652657986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652687073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652693033 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652740955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652760029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652796030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652815104 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652842999 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652936935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652965069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.652991056 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.652991056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653008938 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653040886 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653040886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653095007 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653104067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653162956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653224945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653279066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653323889 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653398991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653431892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653455973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653532982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653563976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653592110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653620005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653625965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653681040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653686047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653742075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653784037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653840065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653867960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.653918028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.653950930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654000044 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654016018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654067993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654069901 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654118061 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654165030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654217005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654218912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654264927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654288054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654337883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654373884 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654401064 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654423952 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654445887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654460907 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654486895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.654494047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.654537916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.681684017 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.681792021 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.681823015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.681824923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.681838989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.681884050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.681915045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.681955099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.729569912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.729707956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770101070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770133972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770189047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770222902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770587921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770632029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770651102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770661116 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770687103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770714998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770718098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770750999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770767927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770780087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770802975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770808935 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770828009 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770837069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770859003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770890951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770891905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770920038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770944118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770948887 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770968914 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.770982027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.770994902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771038055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771178007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771210909 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771233082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771256924 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771294117 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771348953 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771378040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771426916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771445036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771496058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771612883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771647930 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771661997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771696091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771743059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771789074 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771794081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771846056 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771907091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.771954060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.771958113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772005081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772042990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772075891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772094011 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772116899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772167921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772217035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772233963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772275925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772281885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772324085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772367001 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772420883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772464991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772497892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772511959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772546053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772562027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772609949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772686958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772739887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772825003 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772852898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772876024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772902012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.772941113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.772988081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773142099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773205996 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773207903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773241043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773255110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773284912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773288965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773332119 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773351908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773401022 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773438931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773488045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773488998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773536921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773600101 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773647070 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773649931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773696899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773715019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773760080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773760080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773808956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773838997 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773885012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.773914099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.773962975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774066925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774111986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774235010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774293900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774382114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774427891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774429083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774477005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774493933 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774540901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774579048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774626017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774630070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774676085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774694920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774740934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774745941 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774792910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774821043 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.774873018 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.774961948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.775012016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.775074005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.775121927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.775158882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.775203943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.775253057 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.775299072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.775336981 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.775384903 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.801575899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.801610947 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.801637888 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.801671028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.801685095 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.801731110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.801773071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.801819086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.846410990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.846468925 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.849571943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.849637985 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.890786886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.890917063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.890942097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891103029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891150951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891196012 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891216993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891231060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891253948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891278982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891298056 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891350985 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891442060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891494989 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891527891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891556025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891577005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891583920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891606092 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891629934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891809940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891860008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891876936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.891927958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.891978979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892033100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892060041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892117023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892208099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892256975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892333031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892381907 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892421007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892468929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892491102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892537117 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892544031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892592907 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892662048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892694950 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892714024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892739058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892781973 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892832994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892837048 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892894030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.892935991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892967939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.892985106 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893014908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893044949 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893094063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893132925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893179893 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893205881 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893254995 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893281937 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893331051 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893357038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893404007 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893443108 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893476963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893497944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893522978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893553019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893603086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893655062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893704891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893735886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893788099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893831015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893874884 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.893877983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893929958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.893974066 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894023895 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894048929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894098043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894196033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894247055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894469976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894531965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894608974 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894643068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894663095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894701004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894722939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894772053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894790888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894838095 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894841909 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894885063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.894906998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.894958973 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895021915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895068884 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895149946 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895184040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895196915 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895235062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895417929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895450115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895467043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895498991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895499945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895546913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895632982 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895680904 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895731926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895790100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895836115 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895884991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895890951 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.895944118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.895982027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896029949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896044970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896092892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896161079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896209955 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896265030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896296978 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896312952 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896343946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896373987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896420956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896437883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896491051 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.896579981 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.896626949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.921890020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.921932936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.921973944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.922028065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:16.969353914 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:16.969428062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.010704041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.010792017 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.010876894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.010876894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011059046 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011118889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011235952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011285067 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011357069 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011408091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011475086 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011528969 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011576891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011611938 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011625051 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011657000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011710882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011766911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011805058 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011850119 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011878014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.011926889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.011980057 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012012959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012038946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012065887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012101889 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012160063 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012178898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012228966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012254953 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012304068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012353897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012404919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012408972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012465954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012511969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012562990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012665033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012727976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012819052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012868881 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.012880087 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012922049 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.012955904 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013009071 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013067961 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013133049 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013159037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013206005 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013214111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013261080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013303041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013355017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013421059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013454914 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013477087 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013509035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013520956 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013573885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013591051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013641119 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013659954 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013710976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013809919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013847113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013868093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013900995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.013912916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.013957977 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014010906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014067888 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014074087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014137030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014345884 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014400959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014413118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014473915 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014558077 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014614105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014631987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014683008 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014818907 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.014874935 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.014957905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015012980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015073061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015132904 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015141964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015198946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015281916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015336037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015353918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015417099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015424013 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015477896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015485048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015536070 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015683889 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015748978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015835047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015891075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.015943050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.015994072 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016004086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016027927 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016046047 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016087055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016105890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016159058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016196966 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016246080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016252041 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016273975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016294956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016319990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016372919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016421080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016468048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016516924 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016544104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016596079 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016705036 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016735077 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016755104 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016777039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.016871929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.016927958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.041999102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.042038918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.042098045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.042100906 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.042125940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.042129993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.042166948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.089294910 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.089538097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.130918026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.130949020 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.130969048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131005049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131156921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131257057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131270885 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131323099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131357908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131391048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131414890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131438971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131551027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131599903 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131719112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131769896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131865978 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131911993 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.131920099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.131968975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132024050 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132077932 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132142067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132178068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132191896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132211924 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132231951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132258892 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132289886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132343054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132397890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132431984 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132447004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132481098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132522106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132567883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132567883 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132620096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132723093 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132752895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132770061 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132807016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132818937 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132853031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132865906 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132905960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.132920027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132966042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.132967949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133013010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133110046 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133158922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133163929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133212090 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133294106 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133326054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133342028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133378983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133404016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133451939 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133455992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133506060 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133546114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133575916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133596897 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133621931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133688927 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133738995 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133754969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133805037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133827925 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133876085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.133930922 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133981943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.133985996 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134033918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134166002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134198904 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134217024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134251118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134288073 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134335995 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134435892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134464025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134490013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134507895 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134521961 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134536028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134556055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134582043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134646893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134675026 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134701014 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134725094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134726048 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134761095 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134772062 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134808064 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134829044 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.134877920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.134990931 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135024071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135039091 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135072947 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135190964 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135240078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135288000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135340929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135365963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135412931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135442972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135490894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135493994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135539055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135562897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135608912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135611057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135657072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135723114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135751963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135772943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135798931 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135817051 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135868073 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.135953903 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.135982037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136003017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136027098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136077881 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136126995 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136126995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136183977 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136193991 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136245966 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136260033 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136292934 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136315107 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136323929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136343956 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136373997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136416912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136450052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136468887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136502028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136514902 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136563063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.136567116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.136616945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.161969900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.162025928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.162072897 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.162168026 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.202636957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.202888012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.209167004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.209242105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.250832081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251033068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251035929 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251065969 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251094103 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251123905 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251133919 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251190901 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251199961 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251255035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251347065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251379967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251406908 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251437902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251492977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251550913 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251558065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251585960 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251610994 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251625061 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251631975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251682043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251725912 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251782894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251802921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251868010 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.251928091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.251981974 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252012968 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252053976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252072096 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252109051 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252152920 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252209902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252275944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252331018 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252348900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252392054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252403021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252445936 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252469063 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252521038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252623081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252679110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252720118 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252782106 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252912998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252945900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.252969980 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.252998114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253072977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253127098 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253155947 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253215075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253274918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253329039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253463030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253518105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253539085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253593922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253606081 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253664017 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253696918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253751040 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253786087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253839016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253849983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253899097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.253902912 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253952026 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.253973961 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254030943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254072905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254121065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254169941 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254225016 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254276037 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254307985 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254331112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254364967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254396915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254460096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254472971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254493952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254524946 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254554033 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254571915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254623890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254678965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254707098 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254733086 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254740000 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254761934 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254798889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.254858017 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.254914045 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255028009 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255057096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255084038 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255104065 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255117893 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255166054 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255177975 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255204916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255233049 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255237103 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255258083 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255286932 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255294085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255340099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255377054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255429029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255481958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255536079 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255578041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255635023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255703926 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255745888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255759001 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255800962 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.255904913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.255958080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256000996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256048918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256062031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256098032 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256113052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256156921 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256165028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256211996 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256249905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256304979 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256337881 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256387949 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256403923 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256459951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256479979 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256513119 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256532907 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256563902 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256625891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256688118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256803989 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256853104 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256896019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.256948948 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.256973028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.257025957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.257071972 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.257107019 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.257128954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.257168055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.281904936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.282031059 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.282130003 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.322228909 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.322288990 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.328952074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.329013109 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.370874882 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.370949984 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.370961905 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371014118 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371057034 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371119022 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371162891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371212959 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371220112 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371273041 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371356010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371407986 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371474028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371505976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371527910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371562958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371619940 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371680975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371802092 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371850967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371860027 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.371906996 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.371975899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372028112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372102022 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372133017 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372153997 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372179031 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372220993 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372272015 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372282028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372340918 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372363091 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372409105 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372440100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372495890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372570038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372608900 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372622013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372658014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372659922 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372715950 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372746944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372801065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372812986 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372874022 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372880936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372914076 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.372931957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.372972012 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373043060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373090982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373163939 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373197079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373214960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373255968 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373375893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373449087 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373477936 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373533964 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373586893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373619080 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373646975 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373689890 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373749018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373800039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.373837948 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.373893976 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374031067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374083042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374149084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374183893 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374195099 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374231100 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374265909 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374315023 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374406099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374438047 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374459028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374496937 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374535084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374567032 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374588013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374614954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374660015 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374689102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374712944 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374722004 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374737978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374772072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.374919891 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.374975920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375055075 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375117064 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375217915 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375271082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375273943 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375320911 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375387907 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375416994 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375439882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375466108 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375494957 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375538111 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375566006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375619888 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375663996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375696898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375718117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375737906 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375765085 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375819921 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375916958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375946045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375961065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.375978947 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.375993967 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376017094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376045942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376081944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376104116 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376137972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376190901 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376243114 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376286983 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376316071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376342058 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376365900 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376435995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376470089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376488924 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376523972 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376538038 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376593113 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376604080 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376640081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376658916 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376693010 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376705885 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376743078 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376805067 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376857042 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376892090 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.376945019 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.376981974 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.377028942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.377038002 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.377080917 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.401772976 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.401827097 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.401827097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.401860952 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.401876926 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.401912928 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.401912928 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.401972055 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.448793888 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.448853970 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.490175962 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.490237951 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.490612030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.490674019 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.490770102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.490828037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.490854025 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.490906954 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.490978003 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491029024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491085052 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491132021 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491136074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491192102 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491228104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491283894 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491344929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491395950 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491485119 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491537094 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491595030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491627932 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491647005 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491671085 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491715908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491767883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491849899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491898060 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.491904974 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.491949081 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492156029 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492208004 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492244959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492278099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492290974 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492331028 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492376089 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492409945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492430925 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492456913 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492469072 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492512941 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492536068 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492568970 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492593050 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492620945 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492671967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492719889 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492772102 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492820024 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492837906 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.492888927 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.492949963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493001938 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493026018 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493081093 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493132114 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493164062 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493185043 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493221045 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493232965 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493268013 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493299007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493347883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493407965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493458033 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493472099 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493524075 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493558884 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493602991 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493681908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493736982 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493757963 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493808031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493812084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493864059 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.493962049 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.493993998 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494008064 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494043112 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494106054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494158030 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494215965 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494271994 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494313955 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494343042 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494371891 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494398117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494410992 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494457960 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494492054 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494541883 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494632006 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494666100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494688034 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494723082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494745016 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494793892 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494798899 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494849920 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.494893074 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.494946957 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495002031 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495053053 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495193958 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495246887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495300055 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495352983 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495382071 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495433092 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495620966 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495696068 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495708942 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495762110 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495788097 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495835066 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.495867014 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.495919943 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496237040 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496304035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496404886 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496454000 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496455908 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496503115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496588945 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496639967 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496651888 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496692896 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496776104 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496803999 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496830940 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496859074 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.496927977 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.496978998 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497041941 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497071028 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497093916 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497119904 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497137070 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497165918 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497191906 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497198105 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497220039 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497252941 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497265100 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497292995 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.497318029 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.497344971 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.527904987 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.528011084 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.570043087 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.570158958 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610281944 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610375881 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610557079 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610629082 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610627890 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610681057 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610704899 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610745907 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610773087 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610797882 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610802889 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610841990 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.610863924 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.610903978 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611027002 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611061096 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611076117 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611239910 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611310959 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611361980 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611414909 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611443996 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611476898 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611538887 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611557007 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611604929 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611613035 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611702919 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611855030 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.611916065 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.611964941 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.612023115 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.612070084 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.612164974 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.612179041 CET	15666	49704	45.130.145.152	192.168.2.5
Dec 19, 2024 21:35:17.612246037 CET	49704	15666	192.168.2.5	45.130.145.152
Dec 19, 2024 21:35:17.612272024 CET	15666	49704	45.130.145.152	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 21:35:10.034770012 CET	192.168.2.5	1.1.1.1	0xb38f	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 21:35:10.171988964 CET	1.1.1.1	192.168.2.5	0xb38f	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 19, 2024 21:35:10.171988964 CET	1.1.1.1	192.168.2.5	0xb38f	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 19, 2024 21:35:10.171988964 CET	1.1.1.1	192.168.2.5	0xb38f	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.74.152	443	2556	C:\Users\user\Desktop\billys.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 20:35:11 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-19 20:35:11 UTC	424	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 20:35:11 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8f4a2d7e0d2741ac-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1589&rtt_var=610&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=738&delivery_rate=1773997&cwnd=252&unsent_bytes=0&cid=cb6e84a069784aca&ts=458&x=0"
2024-12-19 20:35:11 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	15:35:08
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\billys.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\billys.exe"
Imagebase:	0x7ff72d6f0000
File size:	2'749'952 bytes
MD5 hash:	41F92168B17F6F6E3F0C2DD847B8790C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:35:27
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\billys.exe"
Imagebase:	0x7ff77f5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:35:27
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:35:28
Start date:	19/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff753200000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	98

Executed Functions

Function 00000137C15A31C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 227
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00000137C15A3201
GetSystemMetrics.USER32 ref: 00000137C15A320F
GetSystemMetrics.USER32 ref: 00000137C15A321D
GetSystemMetrics.USER32 ref: 00000137C15A322B
GetDC.USER32 ref: 00000137C15A3235
GetDeviceCaps.GDI32 ref: 00000137C15A324B
GetDeviceCaps.GDI32 ref: 00000137C15A325B
CreateCompatibleDC.GDI32 ref: 00000137C15A3268
CreateCompatibleBitmap.GDI32 ref: 00000137C15A3280
SelectObject.GDI32 ref: 00000137C15A3296
BitBlt.GDI32 ref: 00000137C15A32CC
SHCreateMemStream.SHLWAPI ref: 00000137C15A3302
SelectObject.GDI32 ref: 00000137C15A3318
DeleteDC.GDI32 ref: 00000137C15A3321
ReleaseDC.USER32 ref: 00000137C15A332C
DeleteObject.GDI32 ref: 00000137C15A3335
EnterCriticalSection.KERNEL32 ref: 00000137C15A342C
LeaveCriticalSection.KERNEL32 ref: 00000137C15A343E
IStream_Size.SHLWAPI ref: 00000137C15A3475
IStream_Reset.SHLWAPI ref: 00000137C15A3486
IStream_Read.SHLWAPI ref: 00000137C15A3513
SelectObject.GDI32 ref: 00000137C15A356D
DeleteDC.GDI32 ref: 00000137C15A3576
ReleaseDC.USER32 ref: 00000137C15A3583
DeleteObject.GDI32 ref: 00000137C15A358C

Strings

, xrefs: 00000137C15A32A1

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 128abfd2b101a0e68aac01b1bdead559c1247fe31ad61a4bcdf76249211401bb
Instruction ID: 5882b5d01514aaa110e626f332fe2ab15361ed168458c822805fd4ced3b52028
Opcode Fuzzy Hash: 128abfd2b101a0e68aac01b1bdead559c1247fe31ad61a4bcdf76249211401bb
Instruction Fuzzy Hash: E5B134B2218BC185E770DB21F8543DAB7A5F789B90F409529DA8A53B99DF3CC285CB00

Function 00000137C160B5E0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000137C160B68D
GetLastError.KERNEL32 ref: 00000137C160B697
FindFirstFileW.KERNEL32 ref: 00000137C160B6AE
GetLastError.KERNEL32 ref: 00000137C160B6BA
FindClose.KERNEL32 ref: 00000137C160B6C8
__std_fs_open_handle.LIBCPMT ref: 00000137C160B75B
CloseHandle.KERNEL32 ref: 00000137C160B771
CloseHandle.KERNEL32 ref: 00000137C160B8E4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 85049687b5dde28f65619eec6ecb9dcc7cc2f377e42605e75442889216d79f68
Instruction ID: 9b77160039c7209b6015ad12108c7fbcc5c1682d355c41b12cb64b3caec6d702
Opcode Fuzzy Hash: 85049687b5dde28f65619eec6ecb9dcc7cc2f377e42605e75442889216d79f68
Instruction Fuzzy Hash: 5D91A2B9318A0286F674CB35B8147E96390A785BB4F59A334DAB6677E4DF38CB01C704

Function 00000137C155E240 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00000137C155E32C
GetProcAddress.KERNEL32 ref: 00000137C155E437
GetProcAddress.KERNEL32 ref: 00000137C155E4F9
GetProcAddress.KERNEL32 ref: 00000137C155E573
GetProcAddress.KERNEL32 ref: 00000137C155E5F5
GetProcAddress.KERNEL32 ref: 00000137C155E66F
GetProcAddress.KERNEL32 ref: 00000137C155E6F3
FreeLibrary.KERNEL32 ref: 00000137C155F221

Strings

cannot use push_back() with , xrefs: 00000137C155F26F
system, xrefs: 00000137C155F02D
vault, xrefs: 00000137C155F083

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: f4062f62406b18f2dd86448a1c0b71fafc49e2f1b02768a94a20072dda7b9d37
Instruction ID: b69d534d20d695be4bcca58dfe828edef6b7ea327a7dd1d7d35cd830eb7ab439
Opcode Fuzzy Hash: f4062f62406b18f2dd86448a1c0b71fafc49e2f1b02768a94a20072dda7b9d37
Instruction Fuzzy Hash: CA923872209BC589DB608F29F8843DD73A4F749798F505226EB9C5BB99EF75C684C300

Function 00000137C15E3180 Relevance: 19.8, Strings: 15, Instructions: 1071
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Prologue offset: , xrefs: 00000137C15E42C8
Hook instructions: , xrefs: 00000137C15E4140
Hook size: , xrefs: 00000137C15E4236
Trampoline Jmp Tbl:, xrefs: 00000137C15E408A
Chosen detour scheme: , xrefs: 00000137C15E392A
UNKNOWN, xrefs: 00000137C15E38FC
one, xrefs: 00000137C15E3C30
m_trampolineSz: , xrefs: 00000137C15E3EAA
Original function:, xrefs: 00000137C15E34DF
m_fnAddress: , xrefs: 00000137C15E320A, 00000137C15E3274
failed, xrefs: 00000137C15E383F
Prologue to overwrite:, xrefs: 00000137C15E3CB1
m_trampoline: , xrefs: 00000137C15E3E06
Trampoline:, xrefs: 00000137C15E3F7D
ions, xrefs: 00000137C15E379D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: one$Chosen detour scheme: $Hook instructions: $Hook size: $Original function:$Prologue offset: $Prologue to overwrite:$Trampoline Jmp Tbl:$Trampoline:$UNKNOWN$failed$ions$m_fnAddress: $m_trampoline: $m_trampolineSz:
API String ID: 0-2571529286
Opcode ID: 12d0d61dab19c6ba5c90d19f01c42e52d75ff9f6097753edb5d260c601ad867e
Instruction ID: 0e00223e5974a9701484feed6985deb1cbf199f611348c30589dc977126b9ec4
Opcode Fuzzy Hash: 12d0d61dab19c6ba5c90d19f01c42e52d75ff9f6097753edb5d260c601ad867e
Instruction Fuzzy Hash: 91B22CB2A18BC285EB35DF24F8413D96361F795788F40A226EA4D567DADF78C385C340

Function 00000137C15E4530 Relevance: 17.2, APIs: 1, Strings: 8, Instructions: 1457COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15E486F
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15E5EEF

Strings

jmp, xrefs: 00000137C15E4594
Original function:, xrefs: 00000137C15E489C
Instructions needing translation:, xrefs: 00000137C15E4E7B
m_fnAddress: , xrefs: 00000137C15E489E
Jmp To Prol:, xrefs: 00000137C15E577E, 00000137C15E5B86
Trampoline address: , xrefs: 00000137C15E4F8D
Instructions needing relocation:, xrefs: 00000137C15E4B9E
Instructions needing entry:, xrefs: 00000137C15E4A3C

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $jmp$m_fnAddress:
API String ID: 118556049-1617887432
Opcode ID: 5a392c8cedc923110e87f8ba22833ab0db1c174458d84835618018b0302c2d30
Instruction ID: a505790b4b8e12ed363439ce8c3baffb5d3cb154b27b593f52350623edf6a673
Opcode Fuzzy Hash: 5a392c8cedc923110e87f8ba22833ab0db1c174458d84835618018b0302c2d30
Instruction Fuzzy Hash: 43E29FB2A19BC189EB20DF64F8443ED2761FB55798F54A222DA5D07BDADF78C284C340

Function 00000137C15996D0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 416
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000137C159CDE0: GetCurrentProcess.KERNEL32 ref: 00000137C159CE1B
Part of subcall function 00000137C159CDE0: OpenProcessToken.ADVAPI32 ref: 00000137C159CE2E
Part of subcall function 00000137C159CDE0: GetTokenInformation.ADVAPI32 ref: 00000137C159CE6A

ExitProcess.KERNEL32 ref: 00000137C1599728
OpenMutexA.KERNEL32 ref: 00000137C1599843
ExitProcess.KERNEL32 ref: 00000137C1599853
CreateMutexA.KERNEL32 ref: 00000137C1599872

Part of subcall function 00000137C159D120: GetModuleFileNameW.KERNEL32 ref: 00000137C159D16A

Part of subcall function 00000137C15A86E0: CoInitializeEx.OLE32 ref: 00000137C15A874A

ExitProcess.KERNEL32 ref: 00000137C159994F

Strings

SeDebugPrivilege, xrefs: 00000137C159972F
SeImpersonatePrivilege, xrefs: 00000137C159973B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: 4a5af4b87d766263c0422d380533bad2d24a66ba96cc40c574ff478d8726fc31
Instruction ID: cdcfdcc33b35a408daf502be44515015d1d587402fa2e868d153a6cd1c4b4006
Opcode Fuzzy Hash: 4a5af4b87d766263c0422d380533bad2d24a66ba96cc40c574ff478d8726fc31
Instruction Fuzzy Hash: E8121DF261C986A1EA34EB61F8513DA6361FBD5340F806536E68D42AEBEF78C705C740

Function 00000137C15E4890 Relevance: 15.2, APIs: 1, Strings: 7, Instructions: 1164COMMON

Download Yara Rule

Strings

Original function:, xrefs: 00000137C15E489C
Instructions needing translation:, xrefs: 00000137C15E4E7B
m_fnAddress: , xrefs: 00000137C15E489E
Jmp To Prol:, xrefs: 00000137C15E577E, 00000137C15E5B86
Trampoline address: , xrefs: 00000137C15E4F8D
Instructions needing relocation:, xrefs: 00000137C15E4B9E
Instructions needing entry:, xrefs: 00000137C15E4A3C

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $m_fnAddress:
API String ID: 0-38338247
Opcode ID: 6af574c0485d8ed1bed5b70827fe873a135a1d8654d1e8ddae547184528dee66
Instruction ID: 4f688f1705382e612ca1089c638b6842733569aa388e4304a281fbe1e8f71e25
Opcode Fuzzy Hash: 6af574c0485d8ed1bed5b70827fe873a135a1d8654d1e8ddae547184528dee66
Instruction Fuzzy Hash: 26C26DB2A18BC189EB20DF24F8443ED2761FB55798F54A222DA5D57BDADF78C284C340

Function 00000137C15CA588 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000137C15CA5CD

Part of subcall function 00000137C15C9C34: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15C9C48

Part of subcall function 00000137C15C47C0: HeapFree.KERNEL32 ref: 00000137C15C47D6
Part of subcall function 00000137C15C47C0: GetLastError.KERNEL32 ref: 00000137C15C47E0

Part of subcall function 00000137C15D31D4: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15D311F

_get_daylight.LIBCMT ref: 00000137C15CA5BC

Part of subcall function 00000137C15C9C94: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15C9CA8

_get_daylight.LIBCMT ref: 00000137C15CA832
_get_daylight.LIBCMT ref: 00000137C15CA843
_get_daylight.LIBCMT ref: 00000137C15CA854
GetTimeZoneInformation.KERNEL32 ref: 00000137C15CA87B

Strings

Eastern Summer Time, xrefs: 00000137C15CA939
Eastern Standard Time, xrefs: 00000137C15CA921

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 825fc98fdcdd9e745aef61eaf2050366d0c06eb2b8f3fce5afb6a9a23e83064d
Instruction ID: 3e3e29d5796afaa59c707fdf101f6dde7da93158abcec5cedd9b71d0524440dc
Opcode Fuzzy Hash: 825fc98fdcdd9e745aef61eaf2050366d0c06eb2b8f3fce5afb6a9a23e83064d
Instruction Fuzzy Hash: B0D1A1BA70825286EB30DF25F8617D96BA1F7887D4F44A136EA0A477C7EB38C641C750

Function 00000137C15A2890 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00000137C15A2A5B
InternetOpenUrlA.WININET ref: 00000137C15A2B38
HttpQueryInfoW.WININET ref: 00000137C15A2B99
HttpQueryInfoW.WININET ref: 00000137C15A2C32
InternetQueryDataAvailable.WININET ref: 00000137C15A2C76
InternetReadFile.WININET ref: 00000137C15A2D39
InternetQueryDataAvailable.WININET ref: 00000137C15A2E04
InternetCloseHandle.WININET ref: 00000137C15A2EAE
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15A2F0B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: ec3456ac992806f8490612d3919b847c0d567006da67147138721cadd16efd14
Instruction ID: 6b5144e0c7af850614fd908c628ba4b3093bafa42e12f638e66f1c51aec0f308
Opcode Fuzzy Hash: ec3456ac992806f8490612d3919b847c0d567006da67147138721cadd16efd14
Instruction Fuzzy Hash: D3027E72A18B9586EB20CB69F8403AE77B5F799794F105225EF9C17B99DF78C180C700

Function 00000137C1612268 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000137C1611E4C: _invalid_parameter_noinfo.LIBCMT ref: 00000137C1611E8D
Part of subcall function 00000137C1611E4C: _invalid_parameter_noinfo.LIBCMT ref: 00000137C1611F0B
Part of subcall function 00000137C1611E4C: _invalid_parameter_noinfo.LIBCMT ref: 00000137C1611F5C

CreateFileW.KERNEL32 ref: 00000137C161236E
CreateFileW.KERNEL32 ref: 00000137C16123BE
GetLastError.KERNEL32 ref: 00000137C16123EE
GetFileType.KERNEL32 ref: 00000137C1612403
GetLastError.KERNEL32 ref: 00000137C161240D
CloseHandle.KERNEL32 ref: 00000137C1612440
CloseHandle.KERNEL32 ref: 00000137C16125A3
CreateFileW.KERNEL32 ref: 00000137C16125D8
GetLastError.KERNEL32 ref: 00000137C16125E7

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 88c67a62c97e9640d8f824194156037d4643487aa4b8d57f45b5f64436b2e6ec
Instruction ID: 1b4e63d59fdb991b9920513ac5c5b580b516004b32e842182bffd38f6414077f
Opcode Fuzzy Hash: 88c67a62c97e9640d8f824194156037d4643487aa4b8d57f45b5f64436b2e6ec
Instruction Fuzzy Hash: AAC18E76728A4185EB20CFA9E4917EC3771F349B98F216229DB2A677D5CF34C652C300

Function 00000137C157D2B0 Relevance: 13.6, APIs: 1, Strings: 6, Instructions: 1378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

status, xrefs: 00000137C1581560, 00000137C1581639, 00000137C15816F0, 00000137C15817C3, 00000137C15817E5, 00000137C15817FB, 00000137C158181D, 00000137C1583C17
recursive_directory_iterator::operator++, xrefs: 00000137C15815D8, 00000137C15816A5, 00000137C1581768
exists, xrefs: 00000137C158153E, 00000137C158160C, 00000137C15816CE, 00000137C158179C, 00000137C1583BEE, 00000137C1583F77, 00000137C1583F8C
cannot use push_back() with , xrefs: 00000137C1581585, 00000137C158165E, 00000137C1581715
directory_iterator::directory_iterator, xrefs: 00000137C15817B3, 00000137C15817D5, 00000137C158180D, 00000137C1583C01
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00000137C15815EF, 00000137C1581629, 00000137C158177F

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: 38f6435d5c4f103796c93540da24862deabf6792b336eb1dbb538c525db28cf3
Instruction ID: bbc06f24f698692a10efe94e25bb0c43074182921d4d3247a516585f2576593b
Opcode Fuzzy Hash: 38f6435d5c4f103796c93540da24862deabf6792b336eb1dbb538c525db28cf3
Instruction Fuzzy Hash: 87E22AB2519BC586D670CB19F8813DAB3A0F7C8784F506225EACD57B9AEF78C254CB40

Function 00000137C15A4D10 Relevance: 13.2, APIs: 4, Strings: 2, Instructions: 2660timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00000137C15A5040
GlobalMemoryStatusEx.KERNEL32 ref: 00000137C15A618C

Strings

%d-%m-%Y, %H:%M:%S, xrefs: 00000137C15A6BBB
[UTC, xrefs: 00000137C15A5013

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: GlobalInformationMemoryStatusTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC
API String ID: 3306350720-1656529043
Opcode ID: 14c160205c7fc6cc7ec52d46a483de945ff6a2d4d0703d78b4aef3d2c91322a7
Instruction ID: d55dae62b2b9d9d41c85e8a884f3389e9d4605e5587ed8c8778464d15f92f662
Opcode Fuzzy Hash: 14c160205c7fc6cc7ec52d46a483de945ff6a2d4d0703d78b4aef3d2c91322a7
Instruction Fuzzy Hash: F9538D72A18BC589E720CB64F8403ED77B1F789798F505225EA9D17B9AEF78C680C740

Function 00000137C159C5E0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00000137C159C821
SetFilePointer.KERNEL32 ref: 00000137C159C8D4
ReadFile.KERNEL32 ref: 00000137C159C903

Strings

ios_base::eofbit set, xrefs: 00000137C159CD44
exists, xrefs: 00000137C159CD8A
ios_base::badbit set, xrefs: 00000137C159CD31, 00000137C159CDAF
ios_base::failbit set, xrefs: 00000137C159CD3D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 1afa6a1b7beb83114b8704a3427e9f80589dc1d8d999a44eec9d43898cf7bcb1
Instruction ID: f64d569f8e95c52397ccd0c66f8201c4783265e5d616b3ea8961bf007951b5ed
Opcode Fuzzy Hash: 1afa6a1b7beb83114b8704a3427e9f80589dc1d8d999a44eec9d43898cf7bcb1
Instruction Fuzzy Hash: D93214B2618BC589EB20CF38E8803DD37A1F785788F509226DA4D5BB9AEF74C645C741

Function 00000137C15E83D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00000137C15E8407
LoadLibraryA.KERNEL32 ref: 00000137C15E845F
GetProcAddress.KERNEL32 ref: 00000137C15E8474
GetCurrentProcess.KERNEL32 ref: 00000137C15E847D
VirtualAlloc2.KERNELBASE ref: 00000137C15E84AB

Strings

VirtualAlloc2, xrefs: 00000137C15E846A
kernelbase.dll, xrefs: 00000137C15E8449

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AddressAlloc2CurrentInfoLibraryLoadProcProcessSystemVirtual
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 3240720159-1188699709
Opcode ID: 938162ec5529eeba8205653a98cfbd1f6f15b8febfdf609c6d8605836a059b36
Instruction ID: 31cde25a3d56e842f0a377bba34556ca2af87e2ede69338bda0f85a56eed3318
Opcode Fuzzy Hash: 938162ec5529eeba8205653a98cfbd1f6f15b8febfdf609c6d8605836a059b36
Instruction Fuzzy Hash: 83214A76608B8182EB10CB11F444399B7B0F789B94F945229EB8D03BA4EF78C195CB00

Function 00000137C15CA804 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00000137C15CA832

Part of subcall function 00000137C15C9C94: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15C9CA8

_get_daylight.LIBCMT ref: 00000137C15CA843

Part of subcall function 00000137C15C9C34: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15C9C48

_get_daylight.LIBCMT ref: 00000137C15CA854

Part of subcall function 00000137C15C9C64: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15C9C78

Part of subcall function 00000137C15C47C0: HeapFree.KERNEL32 ref: 00000137C15C47D6
Part of subcall function 00000137C15C47C0: GetLastError.KERNEL32 ref: 00000137C15C47E0

GetTimeZoneInformation.KERNEL32 ref: 00000137C15CA87B

Strings

Eastern Summer Time, xrefs: 00000137C15CA939
Eastern Standard Time, xrefs: 00000137C15CA921

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 397136adc859d5d45b5c6467de8925bfcfcaac6803f9b46935697241e8bd03d1
Instruction ID: 509a655c80a2acf8e6cb490a24c0708b4d891cffc34b841c13cd5ab3038f3b4f
Opcode Fuzzy Hash: 397136adc859d5d45b5c6467de8925bfcfcaac6803f9b46935697241e8bd03d1
Instruction Fuzzy Hash: DB515FF661874286EB30DF25F8A17D977A0F788784F41A13AEA4A837D6DB38C641C750

Function 00000137C1557AA0 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 797fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00000137C1557B7F
FindNextFileW.KERNEL32 ref: 00000137C1558366

Strings

exists, xrefs: 00000137C155877A
content, xrefs: 00000137C155824F
filename, xrefs: 00000137C155815A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$exists$filename
API String ID: 1690352074-1949714836
Opcode ID: 28ac87f937544151472885d607488c3ef3a87751e5fe1dcddcae307987e0c97a
Instruction ID: 8ce735e74a762ef39b6450ece8b911dca4a9db87c35cf3becedfb76e6745cbee
Opcode Fuzzy Hash: 28ac87f937544151472885d607488c3ef3a87751e5fe1dcddcae307987e0c97a
Instruction Fuzzy Hash: AE8270B2618BC295EA30DB25F4543DEB361F784794F446226EA9D07BEADF78C690C700

Function 00000137C15AC9C0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000137C15ACB74
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C15ACB82
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C15ACE05
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C15ACE13

Strings

value, xrefs: 00000137C15ACA9A, 00000137C15ACD33

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: e69498e06bebfe59cd453cb1898f66b618b11fefd0ada655b789859a249e2fe8
Instruction ID: e76e0fea95c0372e2b78ac776d832762a53879b3f517bad26f297dbe72608ad0
Opcode Fuzzy Hash: e69498e06bebfe59cd453cb1898f66b618b11fefd0ada655b789859a249e2fe8
Instruction Fuzzy Hash: E20290B2658BC185EB20DB74F4403ED6761E7857A4F506226FAAD17BEADF78C285C300

Function 00000137C155F2E0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000137C155F32A
Process32FirstW.KERNEL32 ref: 00000137C155F36C
Process32NextW.KERNEL32 ref: 00000137C155F563
CloseHandle.KERNEL32 ref: 00000137C155F7DA

Strings

[PID: , xrefs: 00000137C155F3AE

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: d420e4319dc4d5514a827f1c61fec483df08166f0e02b1f1532b275f7a8d29a6
Instruction ID: d66a941f2659b46ebf9f7224be2b703d1a69fef30f773ccb94a8cbe6ca403e4f
Opcode Fuzzy Hash: d420e4319dc4d5514a827f1c61fec483df08166f0e02b1f1532b275f7a8d29a6
Instruction Fuzzy Hash: CBE160B2618BC185EB30DB25F8903DD77A5F7897A8F505225EA9907BDADF78C244C700

Function 00000137C15A56A0 Relevance: 9.0, APIs: 3, Strings: 1, Instructions: 1985COMMON

Download Yara Rule

Strings

%d-%m-%Y, %H:%M:%S, xrefs: 00000137C15A6BBB

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: %d-%m-%Y, %H:%M:%S
API String ID: 2104809126-3495478971
Opcode ID: 2ed2017c286876f88b12af5a87e5bd0a0d7470d924e1b93492ca881dbcae2454
Instruction ID: 72994ea783a3842ef44c3cbf16cac174fe8cb35ad5e587a5d5d6c0d0f71c9aae
Opcode Fuzzy Hash: 2ed2017c286876f88b12af5a87e5bd0a0d7470d924e1b93492ca881dbcae2454
Instruction Fuzzy Hash: 8A237B72618BC589EB20CB64F8803ED77B5F389788F405225EA9D57B99EF38C694C740

Function 00000137C15A9910 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000137C15A995E
OpenProcessToken.ADVAPI32 ref: 00000137C15A9971
LookupPrivilegeValueW.ADVAPI32 ref: 00000137C15A9992
AdjustTokenPrivileges.ADVAPI32 ref: 00000137C15A99D8
CloseHandle.KERNEL32 ref: 00000137C15A99F8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 8ce77bd8c96780d8ce51cbf27ba3336efb55788d0aa1b2300ace07bcdbe83e4b
Instruction ID: e0daa1df56ce37bfe1dd577575bc02d9bfa4ef23f5147d451c6004de488a5d5f
Opcode Fuzzy Hash: 8ce77bd8c96780d8ce51cbf27ba3336efb55788d0aa1b2300ace07bcdbe83e4b
Instruction Fuzzy Hash: DB216272218B8186E760CF12F44439AB3A4F788B90F959139EA8D57B98DF7DC645CB00

Function 00000137C15EDBC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00000137C160D110: GetCurrentThreadId.KERNEL32 ref: 00000137C160D161
Part of subcall function 00000137C160D110: AcquireSRWLockExclusive.KERNEL32 ref: 00000137C160D180

std::_Throw_Cpp_error.LIBCPMT ref: 00000137C15EDED7
std::_Throw_Cpp_error.LIBCPMT ref: 00000137C15EDEE2
ReleaseSRWLockExclusive.KERNEL32 ref: 00000137C160D12A

Strings

PLH, xrefs: 00000137C15EE086

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Cpp_errorExclusiveLockThrow_std::_$AcquireCurrentReleaseThread
String ID: PLH
API String ID: 3715443949-3073785353
Opcode ID: 194f42d5ca84793d6f8092bc43aa08e6ddaec95eeb91ffeb0a26ce8f79bc2a51
Instruction ID: 07c46f51ae90c79aa3680cf03622330959cc57011a91cab9f674e2e6f7c3840b
Opcode Fuzzy Hash: 194f42d5ca84793d6f8092bc43aa08e6ddaec95eeb91ffeb0a26ce8f79bc2a51
Instruction Fuzzy Hash: 1402F0B2B09B8086EB64CF25F4542A8B7A4FB48B90F09D421DF9947796DF3CCA91C700

Function 00000137C1554A50 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 369registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000137C1554DD2

Strings

status, xrefs: 00000137C15557A9
exists, xrefs: 00000137C15549F2, 00000137C155576E
directory_iterator::directory_iterator, xrefs: 00000137C1554A14, 00000137C155578D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Open
String ID: directory_iterator::directory_iterator$exists$status
API String ID: 71445658-3429586796
Opcode ID: e5264a72e81408a58a012c8a1cbb6d37a5e9ce24cbcada9c2242042ab7c6cb9c
Instruction ID: 016bc20558a310afeb0d826a9dc0e708a019cf5c83ade05d16f11b85163a67cf
Opcode Fuzzy Hash: e5264a72e81408a58a012c8a1cbb6d37a5e9ce24cbcada9c2242042ab7c6cb9c
Instruction Fuzzy Hash: 79121172515FC58AD7B18F39EC803D973A4F789798F116225EA9C1BB9AEF748294C300

Function 00000137C1584200 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

status, xrefs: 00000137C1584F91, 00000137C1584FB3, 00000137C1584FDB, 00000137C1585003
prefs.js, xrefs: 00000137C1585762
exists, xrefs: 00000137C158660D
cannot use push_back() with , xrefs: 00000137C1584F55
directory_iterator::directory_iterator, xrefs: 00000137C1584FA3, 00000137C1586624

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 5c8e91b6557a70d83d38f555a75bc28827d45d3d911cd808a41e66cd1eb3839f
Instruction ID: a55f30bce80339bd5e2f95f2f8e042cb4129c68c956d85a4a2d88601f11459eb
Opcode Fuzzy Hash: 5c8e91b6557a70d83d38f555a75bc28827d45d3d911cd808a41e66cd1eb3839f
Instruction Fuzzy Hash: 62523872509FC585E6B19B15F8813DAB3A4F7C9784F506225DACC53B9AEF38C294CB00

Function 00000137C155D6E0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 00000137C155D742
CredFree.ADVAPI32 ref: 00000137C155E166

Strings

cannot use push_back() with , xrefs: 00000137C155E1B4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 950e0b553469e81efc228039ff5bc1a14f69fb49604413bd7afea1f77073a6bf
Instruction ID: e3ed368c356adbb67c551fb84139233de60aa6fede7cca8f2fe396c6f3af04fb
Opcode Fuzzy Hash: 950e0b553469e81efc228039ff5bc1a14f69fb49604413bd7afea1f77073a6bf
Instruction Fuzzy Hash: D1625DB2618BC589EB308F25F8903DD77A1F789798F505225EAAD17BDADB34C284C740

Function 00000137C1599F00 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000137C1599F63
ShellExecuteW.SHELL32 ref: 00000137C159A5AA

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 48b4ddc7bcf3ada09b84498f3bfe3d6f2476c30260f20d24590befa7b6f1312e
Instruction ID: 25bd34e556fa83531e1a68151bed32db8a3329f9078743a402357094d021e7bc
Opcode Fuzzy Hash: 48b4ddc7bcf3ada09b84498f3bfe3d6f2476c30260f20d24590befa7b6f1312e
Instruction Fuzzy Hash: 17123972629BC48AEB508F29F88069EB3A4F788798F506215FEDD57B59EF78C150C700

Function 00000137C15999C3 Relevance: 3.3, APIs: 2, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000137C155F2E0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000137C155F32A
Part of subcall function 00000137C155F2E0: Process32FirstW.KERNEL32 ref: 00000137C155F36C

Part of subcall function 00000137C155D6E0: CredEnumerateA.ADVAPI32 ref: 00000137C155D742

Part of subcall function 00000137C15BAC90: GetSystemTimeAsFileTime.KERNEL32 ref: 00000137C15BACA4

ReleaseMutex.KERNEL32 ref: 00000137C1599DBF
CloseHandle.KERNEL32 ref: 00000137C1599DC8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Time$CloseCreateCredEnumerateFileFirstHandleMutexProcess32ReleaseSnapshotSystemToolhelp32
String ID:
API String ID: 1097652691-0
Opcode ID: b8641b590a5f67785eee163b3fa7934b70c791c741dd709c52f726e430c1221e
Instruction ID: a929a998ee44a7a473b499d80db0c009b9e112a49d5510d74f96e85aadab4d3c
Opcode Fuzzy Hash: b8641b590a5f67785eee163b3fa7934b70c791c741dd709c52f726e430c1221e
Instruction Fuzzy Hash: 21C1DBB262D9C7A1EA74EB61F8517DE6321FBD1340F806436E58D42AEB9E78C709C740

Function 00000137C1594DB0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00000137C1594E08
LocalFree.KERNEL32 ref: 00000137C1594E9A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 5b4fbf053442e25310b53dca1c7b2668b3ec911186700120499bd6f4c1eedf9a
Instruction ID: 211170c41197ecf79ee5ce90a5dfd6f803d9297272b03e3960081962fbe4abe0
Opcode Fuzzy Hash: 5b4fbf053442e25310b53dca1c7b2668b3ec911186700120499bd6f4c1eedf9a
Instruction Fuzzy Hash: 61415473618B81CEE3208F74E5403ED37A4F75878CF446229EB8916E8ADB79C6A4C345

Function 00000137C15A4A60 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00000137C15A4AD1

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: f6ef34cfcb41f3052617f1b5c8a5d3e54f7dd10a2ea138f4be8893bf6e9d4fff
Instruction ID: 36d1bc003ae03a395fb77c0a7594060910cde4010efb7e31cdae85dcaf59e5b7
Opcode Fuzzy Hash: f6ef34cfcb41f3052617f1b5c8a5d3e54f7dd10a2ea138f4be8893bf6e9d4fff
Instruction Fuzzy Hash: 7E418172A18B8186E720CF25F8803DEB774F794788F546215EA8823B69DB78D6D1D740

Function 00000137C15A37A0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00000137C15A37E5

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e3501e48ad91f9be64b8ae31702ffbc2359b6fc08940a00fe13bacccd3f58a1a
Instruction ID: c54330a157ef9098abd4c4547c4182f68184729b9129ea684de93b9e5e56e81f
Opcode Fuzzy Hash: e3501e48ad91f9be64b8ae31702ffbc2359b6fc08940a00fe13bacccd3f58a1a
Instruction Fuzzy Hash: 2F0180B261C78282E770DF25F8413DAB3A4F798788F445125EA8D4279ADFBCC295CB40

Function 00000137C15A3EC0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 00000137C15A411E

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 0220d059ab561a04e2f7a07c1bbfb59cec5a6b68bb6c96023436828c929fb959
Instruction ID: b72a75c4a126939a1738536711681db070fde782cbb6064417c07dff852c470c
Opcode Fuzzy Hash: 0220d059ab561a04e2f7a07c1bbfb59cec5a6b68bb6c96023436828c929fb959
Instruction Fuzzy Hash: 69C1D8B3E58B8186E720CF78E4413ED7761F7997A8F106315EA9816BDADB78C285C340

Function 00000137C1565430 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00000137C15654B9

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 8703bcf897a27782d48fff385ec9f2f5ba8ce20dd7dcf58d6ef2ee578fa5f6dc
Instruction ID: 48476f4652476a96d270c91dbf4af4d74d19d85f110661e652a9cbdb1a751bad
Opcode Fuzzy Hash: 8703bcf897a27782d48fff385ec9f2f5ba8ce20dd7dcf58d6ef2ee578fa5f6dc
Instruction Fuzzy Hash: 9541C1B361D6E04AD712CB3994113BD7FB2D366B88B1C9162DAD48774ADA2DC216CB10

Function 00000137C155F890 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb19258f271684a36273038384a3233d6140a95c6b12e84aad1fe280be811081
Instruction ID: 530dca4d7c0533662e7fb8c366dd7a2db20c2483eb25202f2d85a0358cc5e15a
Opcode Fuzzy Hash: fb19258f271684a36273038384a3233d6140a95c6b12e84aad1fe280be811081
Instruction Fuzzy Hash: F1722AB2618BC589EB20CB69F8403DD73A5F789798F505325EA9C57B9AEF78C240C740

Function 00000137C1551B70 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19ef6a4cc0a479e1bcce0910f18fc0e4c5a92c8c1d190b71d9c9317b01159b2
Instruction ID: 0329da1afa9afa0911bab6722d246939062516c23510ffdc3bea6d43169c8715
Opcode Fuzzy Hash: b19ef6a4cc0a479e1bcce0910f18fc0e4c5a92c8c1d190b71d9c9317b01159b2
Instruction Fuzzy Hash: 1EF15072619F898AEB208B69F48139D77A5F788798F105315EEDC57B99EB38C290C700

Function 00000137C1552260 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d307b67d4d07b7a273d1f33715b699bd49b42a82532cf781da716d6e2e4a03
Instruction ID: c921f83cfdcd18962c006e4e0a7dac0b3b8f9e63f64e2e17765aa184c1fd3e7c
Opcode Fuzzy Hash: 18d307b67d4d07b7a273d1f33715b699bd49b42a82532cf781da716d6e2e4a03
Instruction Fuzzy Hash: F1F13E72619F888AEB608B69F44139D77A4F78C798F105315EEDC57B99EB78C2908B00

Function 00000137C159C1B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000137C159BF30: InitializeCriticalSectionEx.KERNEL32 ref: 00000137C159BF81
Part of subcall function 00000137C159BF30: GetLastError.KERNEL32 ref: 00000137C159BF8B

EnterCriticalSection.KERNEL32 ref: 00000137C159C1F1
GdiplusStartup.GDIPLUS ref: 00000137C159C218
LeaveCriticalSection.KERNEL32 ref: 00000137C159C226
LeaveCriticalSection.KERNEL32 ref: 00000137C159C254
GdipGetImageEncodersSize.GDIPLUS ref: 00000137C159C262
GdipGetImageEncoders.GDIPLUS ref: 00000137C159C2F6
GdipCreateBitmapFromScan0.GDIPLUS ref: 00000137C159C3C0
GdipSaveImageToStream.GDIPLUS ref: 00000137C159C3DE
GdipDisposeImage.GDIPLUS ref: 00000137C159C443
GdipDisposeImage.GDIPLUS ref: 00000137C159C457

Strings

&, xrefs: 00000137C159C3BA

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: ee4d62d479441ac8687bbf56f85e9b5e7d012d309e883670cf16dba04190e65e
Instruction ID: ee348ca04ea565bbb48f31cd4f580240b2c67b49fe29a0439a0f890e5db36ff7
Opcode Fuzzy Hash: ee4d62d479441ac8687bbf56f85e9b5e7d012d309e883670cf16dba04190e65e
Instruction Fuzzy Hash: F1918CB2204B829AEB30CF21F8007D837A4F759B98F55A225EA4957BD9DF34C656C381

Function 00000137C159D260 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000137C15A2F20: GetUserGeoID.KERNEL32 ref: 00000137C15A2F47
Part of subcall function 00000137C15A2F20: GetGeoInfoA.KERNEL32 ref: 00000137C15A2F61
Part of subcall function 00000137C15A2F20: GetGeoInfoA.KERNEL32 ref: 00000137C15A2FB1

WSAStartup.WS2_32 ref: 00000137C159D3D9
socket.WS2_32 ref: 00000137C159D3FA
htons.WS2_32 ref: 00000137C159D420
inet_pton.WS2_32 ref: 00000137C159D463
connect.WS2_32 ref: 00000137C159D47D
closesocket.WS2_32 ref: 00000137C159D49C
WSACleanup.WS2_32 ref: 00000137C159D4A2

Strings

system, xrefs: 00000137C159D345
geo, xrefs: 00000137C159D386

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 16fb0966fc90cb85cf14914ca2485a0b8e38417945c4e349d9b31bd0cda75556
Instruction ID: a7f01c982f4ac907681f323cc56cbd7f3982e3158329ada1d43e28f81416db8c
Opcode Fuzzy Hash: 16fb0966fc90cb85cf14914ca2485a0b8e38417945c4e349d9b31bd0cda75556
Instruction Fuzzy Hash: CEC19EB2B08B4285EB20DB65F8403DC2372E7557A8F456226DE1D2B7EADE74C656C340

Function 00000137C15A7AD0 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000137C15A7B01
GetProcessId.KERNEL32 ref: 00000137C15A7B0A
RmStartSession.RSTRTMGR ref: 00000137C15A7B2A
RmRegisterResources.RSTRTMGR ref: 00000137C15A7B55
RmGetList.RSTRTMGR ref: 00000137C15A7B8E
RmGetList.RSTRTMGR ref: 00000137C15A7BF0
RmEndSession.RSTRTMGR ref: 00000137C15A7C2B
RmEndSession.RSTRTMGR ref: 00000137C15A7C62
RmEndSession.RSTRTMGR ref: 00000137C15A7C77

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: ac7f17f62b0b4b4372e261901ae0ae280e2f32aacd8c1b6a651c7a63f9ba0fb0
Instruction ID: 68fbe6977a0b151435fcc93fe236866348a44bf3b487f3b431dc3d6618f1673e
Opcode Fuzzy Hash: ac7f17f62b0b4b4372e261901ae0ae280e2f32aacd8c1b6a651c7a63f9ba0fb0
Instruction Fuzzy Hash: F8513B72718A428AF720CFA5F4547ED33A1F748798F505139DE0A67BD9DE34CA068740

Function 00000137C15C6860 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15C6C8D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9b94a69a107c54db95cadec3ec501db3bf40dd5d4aa841dda347b37983c3aaf3
Instruction ID: 2b5d1824c70a9aa88ada6f17dbfe937c841b8783ad1d03c84bb41a124f32d3f9
Opcode Fuzzy Hash: 9b94a69a107c54db95cadec3ec501db3bf40dd5d4aa841dda347b37983c3aaf3
Instruction Fuzzy Hash: E1C1EDB220CB8691E6709F15F4603EE7BA0F788B84F556135EA4A033D7DA78CB56C321

Function 00000137C159C010 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00000137C159C053
EnterCriticalSection.KERNEL32 ref: 00000137C159C065
EnterCriticalSection.KERNEL32 ref: 00000137C159C075
GdiplusShutdown.GDIPLUS ref: 00000137C159C083
LeaveCriticalSection.KERNEL32 ref: 00000137C159C090
LeaveCriticalSection.KERNEL32 ref: 00000137C159C09A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 553be29db5892d5f49380c82de3d8774b7a2741da7bcb8a2912f674bad50868d
Instruction ID: 3589e16823c073808bb9568d8e598a53bd23024c574529e0b18e5c736d378f50
Opcode Fuzzy Hash: 553be29db5892d5f49380c82de3d8774b7a2741da7bcb8a2912f674bad50868d
Instruction Fuzzy Hash: EF112872115B5181EB209F25F84029C7364FB48FA8F68A229DA6D167E4CF39CA97C341

Function 00000137C15DBFA0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000137C15DBFC3
ReadProcessMemory.KERNEL32 ref: 00000137C15DBFEC
GetLastError.KERNEL32 ref: 00000137C15DC000
VirtualQueryEx.KERNEL32 ref: 00000137C15DC01E
ReadProcessMemory.KERNEL32 ref: 00000137C15DC04D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Process$MemoryRead$CurrentErrorLastQueryVirtual
String ID:
API String ID: 2584129402-0
Opcode ID: 79c4906e68a013e8855fbbcd168ab546a4d40a596eb9804f0652fb9c821ebf06
Instruction ID: 7805522edf957abd9cb08e717c63bd528b29eeb8238765a84a842f743c3be0d1
Opcode Fuzzy Hash: 79c4906e68a013e8855fbbcd168ab546a4d40a596eb9804f0652fb9c821ebf06
Instruction Fuzzy Hash: F7215E75218B8582EB709F12FA4478E63A4F756FC0F48502AEF6853B95CF3CC6468740

Function 00000137C159DD50 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 371networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00000137C159E488

Strings

exists, xrefs: 00000137C159E373
ios_base::badbit set, xrefs: 00000137C159E395, 00000137C159E3CC, 00000137C159E40A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: send
String ID: exists$ios_base::badbit set
API String ID: 2809346765-2074760687
Opcode ID: 18ac5732556e2d47ee3119f83c584253550f1c8c31da84fbdde13152a9dfd2d5
Instruction ID: dd85a4d4b7c9c1e543b0f616c73f2cd8b0da760700d4cf6e36e092d166da5338
Opcode Fuzzy Hash: 18ac5732556e2d47ee3119f83c584253550f1c8c31da84fbdde13152a9dfd2d5
Instruction Fuzzy Hash: 7F023BB2619BC281EA31DB18F4953DAA360F7C4784F406236DA9D53BEADF78C645CB40

Function 00000137C159E236 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00000137C15D85D8: RtlPcToFileHeader.KERNEL32 ref: 00000137C15D8628
Part of subcall function 00000137C15D85D8: RaiseException.KERNEL32 ref: 00000137C15D8669

send.WS2_32 ref: 00000137C159E488

Strings

exists, xrefs: 00000137C159E373
ios_base::badbit set, xrefs: 00000137C159E395, 00000137C159E3CC, 00000137C159E40A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaisesend
String ID: exists$ios_base::badbit set
API String ID: 2563112387-2074760687
Opcode ID: c2ed9d43995441ba27536c602e0a3a90baa6752a13320ebdcca74d58982504d5
Instruction ID: 4d21afa663fdfb40101c64fd12f1c7eb0fdf005cc1f0131b5158ac4af7bf1ee4
Opcode Fuzzy Hash: c2ed9d43995441ba27536c602e0a3a90baa6752a13320ebdcca74d58982504d5
Instruction Fuzzy Hash: C65150B2219BC281EA30DB15F4843DAB360F784784F44A132DA8D53BEAEF78C645CB40

Function 00000137C15A3AC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00000137C15A3B29

Strings

ProductName, xrefs: 00000137C15A3B14
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00000137C15A3B1B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 10f3d5730bacd1f619464e985ebce9310f6794da947c255d442cd5462389d98d
Instruction ID: 93c433278385db40d2a7120f66dfc31992086d0ac72eb7ab9a44499327fea864
Opcode Fuzzy Hash: 10f3d5730bacd1f619464e985ebce9310f6794da947c255d442cd5462389d98d
Instruction Fuzzy Hash: 22114C72208B8582E7208F25F44139AF3A4F799798F505226EA9847B99DF7CC255CB40

Function 00000137C15A4740 Relevance: 4.6, APIs: 3, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000137C15A47C9
RegEnumKeyExA.ADVAPI32 ref: 00000137C15A480A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 1e9b86084d8bdee174a8be27c829b56ee5a173848a60e4e3bac61f26fc4f4335
Instruction ID: 9bdbc0dc847d0e1fdc9cb8bbc8ad26b6b5742bec9d94cd05e373129f0e72739b
Opcode Fuzzy Hash: 1e9b86084d8bdee174a8be27c829b56ee5a173848a60e4e3bac61f26fc4f4335
Instruction Fuzzy Hash: 6541B276604B8186F720DBA1F8403AE77B4F78479CF205225EE9813B99CF78C296D700

Function 00000137C15A2F20 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00000137C15A2F47
GetGeoInfoA.KERNEL32 ref: 00000137C15A2F61
GetGeoInfoA.KERNEL32 ref: 00000137C15A2FB1

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: b00e7e739e986762500807f8f5e04299a991fb73d47a4efbdb72625afb2443ee
Instruction ID: 22f581bbd58e4ce58a356f16f5f8acf2019d5214c70ed7de8a64e1d143a98369
Opcode Fuzzy Hash: b00e7e739e986762500807f8f5e04299a991fb73d47a4efbdb72625afb2443ee
Instruction Fuzzy Hash: FC11B27261878182D7208F62F41479EB3A1F784F84F446238EF8503B59DF7CD5908B84

Function 00000137C159CDE0 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000137C159CE1B
OpenProcessToken.ADVAPI32 ref: 00000137C159CE2E
GetTokenInformation.ADVAPI32 ref: 00000137C159CE6A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 0133e95664c9947a1615fea2e98d0114d1399641e70fc236894421ad937b8905
Instruction ID: 6d2a069f03fdff20699751afd19bf59acceee08dfdd7ac277d08fb23be369f92
Opcode Fuzzy Hash: 0133e95664c9947a1615fea2e98d0114d1399641e70fc236894421ad937b8905
Instruction Fuzzy Hash: 5D112E72218B8186E7609F16F84038BB3A5F788B80F54A135EB9A57BA8CF3CC555CB40

Function 00000137C1561CE0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1561ECC

Strings

, xrefs: 00000137C1561D63

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: 7cdde82261053f353be9a4dea2225443be9669019ebd1b596cf1781a00150bc6
Instruction ID: c52149b8aa6ff05b12fd226abdb065c60123fc022d0e1f728ebf99bff7078160
Opcode Fuzzy Hash: 7cdde82261053f353be9a4dea2225443be9669019ebd1b596cf1781a00150bc6
Instruction Fuzzy Hash: 58516BB2308F4596EB259F2AE5903A837A0F385B94F545622CB5D43BE6CF38D5A1C340

Function 00000137C15E96C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15E97EE

Strings

nop, xrefs: 00000137C15E9D14

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: nop
API String ID: 118556049-258488684
Opcode ID: 963a0ee2195fdb65848c24764c6cbeae62cb47b9b1e34926af7401fb864fe669
Instruction ID: 0da93c7464854aa4ff9217fa374ea13185dd72bd493425c892ba9d668a2149e2
Opcode Fuzzy Hash: 963a0ee2195fdb65848c24764c6cbeae62cb47b9b1e34926af7401fb864fe669
Instruction Fuzzy Hash: 7731D2F2719B8681EE34CF05F1443AD6365EB45BE0F549621DAAD07BCADB3CC6958300

Function 00000137C15A42D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00000137C15A430C

Strings

Unknown, xrefs: 00000137C15A43C6

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: eb8bb11cad4d3131ccbcbe4b686e2d6191aa8fcf1fb8f9e7182e59cf72417813
Instruction ID: b2d795e18c820e8b01bc001e5cbe980a86c8b20dc6292487fc74d17f59015e9b
Opcode Fuzzy Hash: eb8bb11cad4d3131ccbcbe4b686e2d6191aa8fcf1fb8f9e7182e59cf72417813
Instruction Fuzzy Hash: F4318F7362CBC1C6E720CB21F5403EAA760F799B44F546225EBC916A8ADB7CC695CB00

Function 00000137C1567F00 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1568040
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C156813F

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d1a35e1284dd0ede8f9f2931e4e084eecdb9e54a8de56f8ee8e1b43c527c036
Instruction ID: 03f8be974d994a41c591a006d49e5ba91d1c620d666f1a3312183e119b682f77
Opcode Fuzzy Hash: 9d1a35e1284dd0ede8f9f2931e4e084eecdb9e54a8de56f8ee8e1b43c527c036
Instruction Fuzzy Hash: AE51D7F2309B4295EE34AB11B5403D9A261E704BE4F686A31DF7D0B7DBDE78C6918340

Function 00000137C1599B7D Relevance: 3.2, APIs: 2, Instructions: 173synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000137C15BAC90: GetSystemTimeAsFileTime.KERNEL32 ref: 00000137C15BACA4

ReleaseMutex.KERNEL32 ref: 00000137C1599DBF
CloseHandle.KERNEL32 ref: 00000137C1599DC8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Time$CloseFileHandleMutexReleaseSystem
String ID:
API String ID: 3470202250-0
Opcode ID: 2f9b2218176f03d8529c6cd8557d816d2f31270fad417685e39cfa18a2e99bb2
Instruction ID: 01bdcc39e4c1fb01f0548b1713452f7a196576bdf00c5cd9a17d9dd96613f0da
Opcode Fuzzy Hash: 2f9b2218176f03d8529c6cd8557d816d2f31270fad417685e39cfa18a2e99bb2
Instruction Fuzzy Hash: E681EBB1B1D986A1EA74EB61F8517EE6321FBD1340F806436E68D42BEBDE28C705C740

Function 00000137C159C490 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00000137C159C4E9
CoTaskMemFree.OLE32 ref: 00000137C159C5AA

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 03c1d143ae1f016aa85a2c83c3734ac7a5810ffa36d58497f4a98336168588a3
Instruction ID: 19dbf65cf60d2482011a78142f53474bb9d485f1be6ae2339b043a05a7aa26ac
Opcode Fuzzy Hash: 03c1d143ae1f016aa85a2c83c3734ac7a5810ffa36d58497f4a98336168588a3
Instruction Fuzzy Hash: 513153B2918B8181E620CF25F44139AB761F7997A4F506325FAAD177D9DB7CC281CB40

Function 00000137C15B25CC Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B25F3

Part of subcall function 00000137C15B2580: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15B2597

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B26A7

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4db28ec5cc50d85a6b518035f2d6b552d0c87938a9db18554e7d210b234c6b03
Instruction ID: 7fd945d8dd877908de0419d8d3ec8d6509d784fca8dfa0797fbe6db089b27165
Opcode Fuzzy Hash: 4db28ec5cc50d85a6b518035f2d6b552d0c87938a9db18554e7d210b234c6b03
Instruction Fuzzy Hash: C931D0B2218A4681EA74EF14F8503E96361E798B80F942535EE4E4B3D7EF38E315C720

Function 00000137C1599DAD Relevance: 3.1, APIs: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00000137C1599DBF
CloseHandle.KERNEL32 ref: 00000137C1599DC8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexRelease
String ID:
API String ID: 4207627910-0
Opcode ID: f90ecf2700116bb50f987c6b228bc0b3b2adf762902c221fe1d0cc924e7359d8
Instruction ID: 55ecb95cf7f09cb66d5e5743f9e7cb60130d47e6a9b97f5c6cda53b0442eb549
Opcode Fuzzy Hash: f90ecf2700116bb50f987c6b228bc0b3b2adf762902c221fe1d0cc924e7359d8
Instruction Fuzzy Hash: 9C315CF2A1E9C691EA30A7A0F4513ED5720EBC1390F807521E69982BEBDE2CCB45C701

Function 00000137C159AB30 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000137C159AB81
RegCloseKey.ADVAPI32 ref: 00000137C159AB93

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 0ffc730ecf2342cc06a5aca2ef89bfa28c2d566f0630244351f65dc329e80760
Instruction ID: dd8f46e79427a2f772b23d445d7a943abfcf879fa0312580cbd894e1044de591
Opcode Fuzzy Hash: 0ffc730ecf2342cc06a5aca2ef89bfa28c2d566f0630244351f65dc329e80760
Instruction Fuzzy Hash: 6421C9B5719A8145FE70EB21F8403EAA361EB95BD4F486135FA4D47BDADF28C682C700

Function 00000137C15C6DD0 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00000137C15C6E1C
GetLastError.KERNEL32 ref: 00000137C15C6E26

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fa5c7f9d9058102a339b1f8801f6c71374a1739474c7be3f72ee9b3e1220e4dc
Instruction ID: 85c9349aecd7bdd8cd90f953e708d4ef0596d404e3ce57aaff8288f19957dbaf
Opcode Fuzzy Hash: fa5c7f9d9058102a339b1f8801f6c71374a1739474c7be3f72ee9b3e1220e4dc
Instruction Fuzzy Hash: 0311A7B2318B8185DA308F25F41429A6761A789BF4F946336EE79077DACF78C651C740

Function 00000137C15D5FD8 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15D6008

Part of subcall function 00000137C15D702C: std::bad_alloc::bad_alloc.LIBCMT ref: 00000137C15D7035

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15D600E

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 700c0b634ef59ceaedef228731b8f5f3f8ef2add7014226fde75a431e4dcd748
Instruction ID: 690155ccc107c76ab7b992d6f8887c7f30b20be289e643287dbb8191c3750d10
Opcode Fuzzy Hash: 700c0b634ef59ceaedef228731b8f5f3f8ef2add7014226fde75a431e4dcd748
Instruction Fuzzy Hash: 73E017F161920786FE3872763A163E900600B193B0F2C3B30EE75087C7FD1486968710

Function 00000137C15C47C0 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00000137C15C47D6
GetLastError.KERNEL32 ref: 00000137C15C47E0

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: abaf095cda3fb664b3aa4b8c8c2c8800b2f27dab971ce25a3c5a706c4b96f9de
Instruction ID: 192c7a7e935598c1e68435f9415471bb216c3ce2a81f73e6df185bb63e890b28
Opcode Fuzzy Hash: abaf095cda3fb664b3aa4b8c8c2c8800b2f27dab971ce25a3c5a706c4b96f9de
Instruction Fuzzy Hash: 36E08CF471820282FF38ABB2BC943E522906B88740F447438CE01423D3EE3C8B538620

Function 00000137C159A6D0 Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C159A862

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ec8561cf41ef0301ffd7a2d2546d6cc023aaa0fb3c6c9018833777b9054f893a
Instruction ID: 510e20606ae8382cbe14a51494b126d368a02a8b84faff220717a8f4a8684ddc
Opcode Fuzzy Hash: ec8561cf41ef0301ffd7a2d2546d6cc023aaa0fb3c6c9018833777b9054f893a
Instruction Fuzzy Hash: B3B190B6618B8185EB20EB65F4443DD63A5F3887A4F545222EAAD07BDADF78C641C700

Function 00000137C15B12A0 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15B14F0

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: fd5a8501b7403251c438327642f0845c95d6bfc7be1a6731c41452bd74eeb8af
Instruction ID: 4a666d4043731f8e89ef277313ab9dfa98754a0655457e00ed0259f0ae61286b
Opcode Fuzzy Hash: fd5a8501b7403251c438327642f0845c95d6bfc7be1a6731c41452bd74eeb8af
Instruction Fuzzy Hash: 8A61AFB2309A4185EAB5DF16F1943AD23A1E702FD8F54A531DE6D0B7D6DB39CA86C300

Function 00000137C15509E0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00000137C1550B13

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: d4662e6dd28ab28fd1f8b0485095b868be17f9ef920e149e56f9fc8bc94bc2f5
Instruction ID: 1d63afd32352ec5aa770035cc4e710b8bbbd937d566ddeedeb4e63cfacc08c43
Opcode Fuzzy Hash: d4662e6dd28ab28fd1f8b0485095b868be17f9ef920e149e56f9fc8bc94bc2f5
Instruction Fuzzy Hash: B061B5B2B18B4285FB20DF69F4903DD23A1E7447A8F406635EE2A577DAEA74C6918340

Function 00000137C156CA21 Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C156CB48

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: abac059017539db2fe5e91c614468fb38c9d14f53ddebfa2a57e7117d38ccdca
Instruction ID: f42f741af6e2fecbb297ed2d08ab338917308720a3e66d445b1d9857c9556c0a
Opcode Fuzzy Hash: abac059017539db2fe5e91c614468fb38c9d14f53ddebfa2a57e7117d38ccdca
Instruction Fuzzy Hash: 5151C1B2309B8581EE24DB16F4542AAA754F344BE4F909A25DFBD17BDADB38C291C340

Function 00000137C1568820 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15689B5

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0625e2a57b2940f18aecb30958d785381e2e5ab939295e65a8d30287c75f6061
Instruction ID: 448ee645d195e02f9710fa51d1326c40e9a404e26d946ba7f2e5ada0d0059c69
Opcode Fuzzy Hash: 0625e2a57b2940f18aecb30958d785381e2e5ab939295e65a8d30287c75f6061
Instruction Fuzzy Hash: F1419DF2309B8285EA209B12F5483DE6361F749BD4F681A35DEAD0B7CADF38C6518340

Function 00000137C158DF10 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C158E0B7

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f9d92651a52d1f8f4d3c4f5bbe7dca86c4b1f93125e7df823a10d2576a29c839
Instruction ID: fd1386a0ce6a371db2c8a475c588434aa7af7bff97a720f17960eee5e7a4a6bc
Opcode Fuzzy Hash: f9d92651a52d1f8f4d3c4f5bbe7dca86c4b1f93125e7df823a10d2576a29c839
Instruction Fuzzy Hash: 814181B2319B8581EA34DB55F5442AEA3A1F748BD4F645626EBAD07FD6DF38C241C300

Function 00000137C15A38E0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00000137C15A3970

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 2dd363a5ee7cbc891ccd701aa69a80896b39b6bc562982c0798c8cb57edeb5d1
Instruction ID: 71b0de9282b5aa333a0d284d10da142f8edf7f5fb9088ae79323ff82366d2d02
Opcode Fuzzy Hash: 2dd363a5ee7cbc891ccd701aa69a80896b39b6bc562982c0798c8cb57edeb5d1
Instruction Fuzzy Hash: B6517C72A18B8189E720CF68F8403ED7774F799788F505226EA9C53B9ADF78C685C740

Function 00000137C15689D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1568B4C

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f2f6d2dee27b991e442a951bfe8c8af2a4e38b6cfd175bab8ff4242bc59d175e
Instruction ID: 3ba206d3ac9d106274f7a2dd4e0eda61d56a0264a0edb0946f50c069864189b8
Opcode Fuzzy Hash: f2f6d2dee27b991e442a951bfe8c8af2a4e38b6cfd175bab8ff4242bc59d175e
Instruction Fuzzy Hash: 9141A0F2309B4295EE30AB16B5043DDA261A708BE4F685631DF6D0B7DBDE78C691C340

Function 00000137C1563970 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1563AC1

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: dc6bcba550347ac48923702180c691ab9502a768c8d52442d3d87bc02f8802e1
Instruction ID: 0d2f035e594319e18fa398baff3cf58bd744de02b89203c526d1427c17ce0fb0
Opcode Fuzzy Hash: dc6bcba550347ac48923702180c691ab9502a768c8d52442d3d87bc02f8802e1
Instruction Fuzzy Hash: 7B3114F271968684FE75AB11F5043ED12519704FE4F58A631DE2D07BCBEA74C6819380

Function 00000137C15C4CC0 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15C4CE8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 76e28fae2e854d81d0b5a505d9f7a92865f6930615b6cd3ebde99649f702df59
Instruction ID: b64f320d7c30324efeb80af5bf4f911c73fac2becc3201ab25f7f3b3e1e289eb
Opcode Fuzzy Hash: 76e28fae2e854d81d0b5a505d9f7a92865f6930615b6cd3ebde99649f702df59
Instruction Fuzzy Hash: 8041F5B210870287EA74DF19F5607EDB3A0F75AB84F102524DB96877D6CB38D602C761

Function 00000137C15686B0 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C156880B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b25afc3407e316d0a1ac23ada3eac79bbc304c6b9082724a0b3c479f452ea344
Instruction ID: b8340c95e0c779ad243d64451b0b2327b54fb04b2411e850db25d52b61d40a21
Opcode Fuzzy Hash: b25afc3407e316d0a1ac23ada3eac79bbc304c6b9082724a0b3c479f452ea344
Instruction Fuzzy Hash: F43105F230978295EE309B22B5443DD6265A304BD4F585631DEAD0B7DBDE3CD261C340

Function 00000137C15627F0 Relevance: 1.6, APIs: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15628F8

Part of subcall function 00000137C154DF10: __std_exception_copy.LIBVCRUNTIME ref: 00000137C154DF58

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: a2a7ade0f6edcc97cde3f6362f44c01b02e4d2e372d71427fb8b2e04ca0224a3
Instruction ID: e50e5c6976f2be8a412f8b351d63359e7119b6d170e14aa8eedda9bc327c04ed
Opcode Fuzzy Hash: a2a7ade0f6edcc97cde3f6362f44c01b02e4d2e372d71427fb8b2e04ca0224a3
Instruction Fuzzy Hash: 4121C3B2B09B5241EA39AB15B5403EC6390E754BE4F245631EA7C07BD7EB78C6D29380

Function 00000137C15C6740 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15C67C6

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6a424a1862e252f104d98a22ed7854e0b12ee2544baf2a2213fde03138f9aae
Instruction ID: acf2032d61bc226b5b1e57a9708ccfe9482db6236c1ab9016de26d0f5fe4270f
Opcode Fuzzy Hash: d6a424a1862e252f104d98a22ed7854e0b12ee2544baf2a2213fde03138f9aae
Instruction Fuzzy Hash: D431C0B2618A1296F731AF15B8513ED2BD0A788BA0F417925EE25033D3EB78C752C771

Function 00000137C1611B08 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C1611B2B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 70bf896b561adad378154b5a9aa75eb806a5c363bda8e4fba91d540825785324
Instruction ID: 45d9ef144569e3a02d4a80582a5369911ca64d1a54fe58fde94cca801a065169
Opcode Fuzzy Hash: 70bf896b561adad378154b5a9aa75eb806a5c363bda8e4fba91d540825785324
Instruction Fuzzy Hash: C121A1B2218A8287DB718F28F4803A976A1F785B94F255234EB59476D9EF38CA05CB00

Function 00000137C160FCD4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C160FC31

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b874b2431c390e4c3ce94b2b4c494386b5c7e2e88d760d95cc96ba2d081e1a
Instruction ID: 36136de5617d4e004c722c3713116b63c8c678f9e398a9fe8f6141b0ed7b2c62
Opcode Fuzzy Hash: 61b874b2431c390e4c3ce94b2b4c494386b5c7e2e88d760d95cc96ba2d081e1a
Instruction Fuzzy Hash: EB1184B260C64182FA70DF51B9013EFA3A0BB85B80F4464B1EF88677CADF79CA519754

Function 00000137C15FC4B0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00000137C15FC4C4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6d2310d077955d8aea653d85a9e0a070073bd4ce5a7b7d11e752ffe5c3d7ecfc
Instruction ID: f52f225b8fe33beaae0e80ce8bdb3554233f91ee0b663cd10cdbec615dc1c102
Opcode Fuzzy Hash: 6d2310d077955d8aea653d85a9e0a070073bd4ce5a7b7d11e752ffe5c3d7ecfc
Instruction Fuzzy Hash: 33F03774B087468BE768CB2DBC1525A33E1F389700F40513DEA4EC37A4EA38DA118B40

Function 00000137C1558323 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000137C1558366

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 023abc5ec8dec306f4c56b2b1cb79829ee1d5b09c77f80c48eebe4a5235393d5
Instruction ID: c7ef9f266f1f99d18cd8ba202bdd9bdc16af6cfb58109bb236d438668468f891
Opcode Fuzzy Hash: 023abc5ec8dec306f4c56b2b1cb79829ee1d5b09c77f80c48eebe4a5235393d5
Instruction Fuzzy Hash: 4501127621CAC185EB70DB52F8943DAB364F788B95F845022DF9D53B99DE38C946CB00

Function 00000137C15B2CE4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B2D03

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bfd1af2436c86cf97cc9b7188a38bc2e51aa77262de0214f2f9b059f75a9b1dc
Instruction ID: ebd7ce8b3b3076285178b1a4e00d69bef8c366371d85350087535f4a3eb2358a
Opcode Fuzzy Hash: bfd1af2436c86cf97cc9b7188a38bc2e51aa77262de0214f2f9b059f75a9b1dc
Instruction Fuzzy Hash: 2AE022B120CA0345EB74ABA4F1403A97190AF447B0F10A731EE38023CBDA2086A14620

Function 00000137C160B4F0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000137C160B4F4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 53218ea80e347e6865bdeee8b0f03a3a5d87b1e304366d91bc4bbfa512aed3a1
Instruction ID: f5a2fec3771c37021f8ea32d09d102d1cb24772a2c0f06c79bf26e7a690179d5
Opcode Fuzzy Hash: 53218ea80e347e6865bdeee8b0f03a3a5d87b1e304366d91bc4bbfa512aed3a1
Instruction Fuzzy Hash: A9C04C69F19502C1E6641B767D8638111906754701FC09074C30490190DE1C82A74A11

Function 00000137C160D0E4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000137C160D0ED

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 31ef5172387b0c087c3910bc7c9ebda6b906d006f82425aae53580b4b20e881b
Instruction ID: 683eb907c7ae76a4fa80017966de15d3a543da6b47bb5c958a64521bd7070c22
Opcode Fuzzy Hash: 31ef5172387b0c087c3910bc7c9ebda6b906d006f82425aae53580b4b20e881b
Instruction Fuzzy Hash: EFB09276A188C0C3C621FB04F8421597331FB94B08FD00010E28942666CE2CCA6A8F00

Function 00000137C15FCE70 Relevance: 1.4, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00000137C15FC4B0: GetSystemInfo.KERNEL32 ref: 00000137C15FC4C4

InitializeCriticalSection.KERNEL32 ref: 00000137C15FCF40

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CriticalInfoInitializeSectionSystem
String ID:
API String ID: 3396500325-0
Opcode ID: dc4482ca8e0435746fbe169b04928ad9b92026c57d372a0786afd09550947472
Instruction ID: 9b6dc10859a9bcfe57fd95450d4c83b71b8202b1ae77fa8875985422dbb9e7aa
Opcode Fuzzy Hash: dc4482ca8e0435746fbe169b04928ad9b92026c57d372a0786afd09550947472
Instruction Fuzzy Hash: 7741BF73A04B898AD720CF16F440A8EBBA8F768BD0F559035DF9943BA1DB38D691C700

Function 00000137C15C4E28 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000137C15C4E7D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 93459845f911a6eca184272eb9e7dca726b4e6dbea886ee78a2622d72edc0e7b
Instruction ID: 7e91d10644bfb3a1edbd493ff5824caddf3c8f7cbe9657f746f3c3e6ccfe8be1
Opcode Fuzzy Hash: 93459845f911a6eca184272eb9e7dca726b4e6dbea886ee78a2622d72edc0e7b
Instruction Fuzzy Hash: CEF06DF430D70689FE746EA679607E902945B8CB80F4D7434CD0A867C3DE2CC6818A32

Function 00000137C15C714C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000137C15C718A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4ecfee661c4bf62e861df5f9f5e7a1dae78cf794a289f64c5eca19dba9fd3138
Instruction ID: e6aea0f7539f7c4ff0c3516d5d26e26f7c9195b33cacab1a80b5a7beb4535abb
Opcode Fuzzy Hash: 4ecfee661c4bf62e861df5f9f5e7a1dae78cf794a289f64c5eca19dba9fd3138
Instruction Fuzzy Hash: 3AF01CB530934749FE746AB27DA17E516915BCC7A0F086B34DD3685BC3DF28C641C620

Non-executed Functions

Function 00000137C15B4EC0 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B51F7
_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B545A
_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B571D
_invalid_parameter_noinfo.LIBCMT ref: 00000137C15B59BD
memcpy_s.LIBCPMT ref: 00000137C15B5BCA
memcpy_s.LIBCPMT ref: 00000137C15B5C66
memcpy_s.LIBCPMT ref: 00000137C15B611E
memcpy_s.LIBCPMT ref: 00000137C15B6159
memcpy_s.LIBCPMT ref: 00000137C15B6285
memcpy_s.LIBCPMT ref: 00000137C15B63AC
memcpy_s.LIBCPMT ref: 00000137C15B6457
memcpy_s.LIBCPMT ref: 00000137C15B649F
memcpy_s.LIBCPMT ref: 00000137C15B64C9
memcpy_s.LIBCPMT ref: 00000137C15B657A
memcpy_s.LIBCPMT ref: 00000137C15B677A
memcpy_s.LIBCPMT ref: 00000137C15B67BF
memcpy_s.LIBCPMT ref: 00000137C15B6876
memcpy_s.LIBCPMT ref: 00000137C15B69A3
memcpy_s.LIBCPMT ref: 00000137C15B606E

Part of subcall function 00000137C15B7304: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15B7336

memcpy_s.LIBCPMT ref: 00000137C15B60E9
memcpy_s.LIBCPMT ref: 00000137C15B6B5D

Strings

, xrefs: 00000137C15B6A50
, xrefs: 00000137C15B6923

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 5e39915bf05eb7d447e4c5a4b771afda0dddd5ff4239f102f908e97f1b882645
Instruction ID: 849b505378b79dae474363b349b374c8266b78e0194e39b03be00616e98741e2
Opcode Fuzzy Hash: 5e39915bf05eb7d447e4c5a4b771afda0dddd5ff4239f102f908e97f1b882645
Instruction Fuzzy Hash: 2703AFB26292C28FE779CE25F9507EA37A1F344788F506125EE06A7BC9D7359B01CB40

Function 00000137C15A8390 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00000137C15A83D3
NtAllocateVirtualMemory.NTDLL ref: 00000137C15A840B
lstrcpyW.KERNEL32 ref: 00000137C15A846D
lstrcatW.KERNEL32 ref: 00000137C15A8522
NtAllocateVirtualMemory.NTDLL ref: 00000137C15A85A9
lstrcpyW.KERNEL32 ref: 00000137C15A865C
RtlInitUnicodeString.NTDLL ref: 00000137C15A8671
RtlInitUnicodeString.NTDLL ref: 00000137C15A8686
LdrEnumerateLoadedModules.NTDLL ref: 00000137C15A8699
RtlReleasePebLock.NTDLL ref: 00000137C15A869F

Part of subcall function 00000137C159C490: SHGetKnownFolderPath.SHELL32 ref: 00000137C159C4E9
Part of subcall function 00000137C159C490: CoTaskMemFree.OLE32 ref: 00000137C159C5AA

CoInitializeEx.OLE32 ref: 00000137C15A874A
lstrcpyW.KERNEL32 ref: 00000137C15A8929
lstrcatW.KERNEL32 ref: 00000137C15A8B2E
CoGetObject.OLE32 ref: 00000137C15A8B4C
lstrcpyW.KERNEL32 ref: 00000137C15A91C9
lstrcatW.KERNEL32 ref: 00000137C15A93EC
CoGetObject.OLE32 ref: 00000137C15A940A
CoUninitialize.OLE32 ref: 00000137C15A98D2

Strings

0, xrefs: 00000137C15A900A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: b663ce192f128047df3ca0d5538c5c19d669f7349dd2ab365df8939ccc36ff6b
Instruction ID: 03234b8149aee9ab0e88a937b45c8938b059c00453d42b46135f0a77c46a276b
Opcode Fuzzy Hash: b663ce192f128047df3ca0d5538c5c19d669f7349dd2ab365df8939ccc36ff6b
Instruction Fuzzy Hash: 30C2A636626F848AD7908F69F88169EB3B5F788788B506219FECD57B18EF38C154C740

Function 00000137C156F570 Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1570BF1
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1570C9F

Part of subcall function 00000137C154E1B0: __std_exception_copy.LIBVCRUNTIME ref: 00000137C154E1F3

Part of subcall function 00000137C15D85D8: RtlPcToFileHeader.KERNEL32 ref: 00000137C15D8628
Part of subcall function 00000137C15D85D8: RaiseException.KERNEL32 ref: 00000137C15D8669

Strings

#include, xrefs: 00000137C156FF49
No closed word, xrefs: 00000137C1570BF7, 00000137C1570C1E
*, xrefs: 00000137C156F88D
key declared, but no value, xrefs: 00000137C1570B3D, 00000137C1570B64, 00000137C1570C51
unexpected '}', xrefs: 00000137C1570CCC
/, xrefs: 00000137C156F862
object is not closed with '}', xrefs: 00000137C1570AEF
key opened, but never closed, xrefs: 00000137C1570C78
word wasnt properly ended, xrefs: 00000137C1570CA5
#base, xrefs: 00000137C156FF75
quote was opened but not closed., xrefs: 00000137C1570B16, 00000137C1570B8B
", xrefs: 00000137C156FA63
unexpected key without object, xrefs: 00000137C1570BCA
Unexpected eof, xrefs: 00000137C1570AC2

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 3c0570c8997c449789c997a7ae96020f64c060ce34e039c99b99b1bda55cec00
Instruction ID: 86aaf2c3ed3f101b7ad66c331861e129acbfb0673576f4512d4b0ea0a8ea32e3
Opcode Fuzzy Hash: 3c0570c8997c449789c997a7ae96020f64c060ce34e039c99b99b1bda55cec00
Instruction Fuzzy Hash: 20D289B2628AC689EB709F24F8543DD23A1F745788F44A222DA5D1BBDADF74C785C340

Function 00000137C15E2000 Relevance: 28.9, APIs: 2, Strings: 14, Instructions: 900COMMON

Download Yara Rule

Strings

AsmTK error: , xrefs: 00000137C15E2DCD
lea rsp, [rsp - 0x80], xrefs: 00000137C15E2243
Translation address: , xrefs: 00000137C15E2E92
], , xrefs: 00000137C15E2B2F
invalid map<K, T> key, xrefs: 00000137C15E2F61
mov , xrefs: 00000137C15E2830
AsmJit error: , xrefs: 00000137C15E2E48
pop , xrefs: 00000137C15E2B94, 00000137C15E2BC5
ret , xrefs: 00000137C15E1E67, 00000137C15E1ED4, 00000137C15E2009
Translation:, xrefs: 00000137C15E2D1D
, xrefs: 00000137C15E2AA1
, [, xrefs: 00000137C15E2858
push , xrefs: 00000137C15E2295, 00000137C15E2427
mov [, xrefs: 00000137C15E2B1B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: $, [$AsmJit error: $AsmTK error: $Translation address: $Translation:$], $invalid map<K, T> key$lea rsp, [rsp - 0x80]$mov $mov [$pop $push $ret
API String ID: 0-682514236
Opcode ID: 9432681d963eee391d34f2082bc0c1e1f2a116e319f2ba3c8b06b0de1f275e4a
Instruction ID: 142cd22bff400a4c4afc17953edd07dfcab8f5706c20e5325442a31ee5e4032d
Opcode Fuzzy Hash: 9432681d963eee391d34f2082bc0c1e1f2a116e319f2ba3c8b06b0de1f275e4a
Instruction Fuzzy Hash: 9E925BB2A18AC285EB31DF24F8443D92361F795788F40A222DA5D5ABDBDF78C785C340

Function 00000137C1571070 Relevance: 24.1, APIs: 2, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1572781
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1572856

Strings

#include, xrefs: 00000137C1571ADA
object is not closed with '}', xrefs: 00000137C157267F
key opened, but never closed, xrefs: 00000137C157282F
word wasnt properly ended, xrefs: 00000137C15727D5, 00000137C157285C
No closed word, xrefs: 00000137C1572787, 00000137C15727AE
#base, xrefs: 00000137C1571B06
quote was opened but not closed., xrefs: 00000137C15726A6, 00000137C157271B
key declared, but no value, xrefs: 00000137C15726CD, 00000137C15726F4, 00000137C1572808
unexpected '}', xrefs: 00000137C1572883
unexpected key without object, xrefs: 00000137C157275A
Unexpected eof, xrefs: 00000137C1572652

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-1838291449
Opcode ID: 2c02071b8227824a654aeb3b60ab0574758a6001475c75d3b1948f9cedfa40c2
Instruction ID: 8d2722a5c14e64deffb31a2e560a91b5a75c05e000fd51e20289190dee6913c4
Opcode Fuzzy Hash: 2c02071b8227824a654aeb3b60ab0574758a6001475c75d3b1948f9cedfa40c2
Instruction Fuzzy Hash: EDE27CB2219AC689EB719F25F8853EC23A1F745788F44A122DA5D0BBDADF74C785C340

Function 00000137C15A7C90 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000137C15A7CD6
GetProcAddress.KERNEL32 ref: 00000137C15A7CE6
OpenProcess.KERNEL32 ref: 00000137C15A7D18
NtQuerySystemInformation.NTDLL ref: 00000137C15A7D40
NtQuerySystemInformation.NTDLL ref: 00000137C15A7D6E
GetCurrentProcess.KERNEL32 ref: 00000137C15A7E33
NtQueryObject.NTDLL ref: 00000137C15A7E79
GetFinalPathNameByHandleA.KERNEL32 ref: 00000137C15A7F6D
CloseHandle.KERNEL32 ref: 00000137C15A8088
CloseHandle.KERNEL32 ref: 00000137C15A8118

Strings

ntdll.dll, xrefs: 00000137C15A7CCF
NtDuplicateObject, xrefs: 00000137C15A7CDF
File, xrefs: 00000137C15A7EAA

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: a624ba69bbab064b290267bb95dc78188409e9aeb6f61e2e23a31bd26d907d92
Instruction ID: fa7ca8e338a3c359cb72607619411e2184391c0105cc8362bd601c3143d9d9de
Opcode Fuzzy Hash: a624ba69bbab064b290267bb95dc78188409e9aeb6f61e2e23a31bd26d907d92
Instruction Fuzzy Hash: 09E1B0B2B58A8189FB20DBB5F8143ED23A1F744B88F409125DE5D17BDADE79C64AC340

Function 00000137C1591F40 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00000137C1591F9F

Strings

@, xrefs: 00000137C1592126

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @
API String ID: 2538663250-2766056989
Opcode ID: 8e49958c298e53590e29ae62adf3b30a3f2115705bc347f5abb6f89c9940a91e
Instruction ID: 83991e899ac33b573a0debeda4e57ebc7000e8704ed2903e3a1a24869cd441db
Opcode Fuzzy Hash: 8e49958c298e53590e29ae62adf3b30a3f2115705bc347f5abb6f89c9940a91e
Instruction Fuzzy Hash: FFA179B2B08A818AE720CB65F4443ED7771F788B98F006229DE5A13BD9DF39C295C340

Function 00000137C15982D0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00000137C1598857

Strings

.ps1, xrefs: 00000137C1598364
.cmd, xrefs: 00000137C1598393
ios_base::eofbit set, xrefs: 00000137C1598A7C
ios_base::badbit set, xrefs: 00000137C1598A6A
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00000137C1598464
.vbs, xrefs: 00000137C15983C2
open, xrefs: 00000137C15987CD
.exe, xrefs: 00000137C1598335
.exe, xrefs: 00000137C159841D
ios_base::failbit set, xrefs: 00000137C1598A75
runas, xrefs: 00000137C15987D6

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: be63988a5b8f2af6a64ad92dbab525889649630b6bd7050345156fc1b4cf4a77
Instruction ID: 56ca71ce4d0b40f0c0a1ce96a089aa489fef8c70e4282ba8ebfb62560093274e
Opcode Fuzzy Hash: be63988a5b8f2af6a64ad92dbab525889649630b6bd7050345156fc1b4cf4a77
Instruction Fuzzy Hash: CE22B1B2A14B8585EB20DF38F8403DD67A1F784798F50A226EA5D57BEADF74C285C340

Function 00000137C15E6C00 Relevance: 18.8, Strings: 14, Instructions: 1262COMMON

Download Yara Rule

Strings

dword, xrefs: 00000137C15E6E0C
qword, xrefs: 00000137C15E6CE9
Unexpected register: , xrefs: 00000137C15E7FA1
Unexpected scratch register: , xrefs: 00000137C15E784A
word, xrefs: 00000137C15E6ED3
eax, xrefs: 00000137C15E6DE6, 00000137C15E6EAB
r15, xrefs: 00000137C15E75CC, 00000137C15E7969, 00000137C15E79BB
invalid map<K, T> key, xrefs: 00000137C15E81AB
byte, xrefs: 00000137C15E6F29
Failed to detect pointer size: , xrefs: 00000137C15E70DB
mov, xrefs: 00000137C15E6DC9
rax, xrefs: 00000137C15E6DDF
Unexpected size of immediate: , xrefs: 00000137C15E7506
r14, xrefs: 00000137C15E79B4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: Failed to detect pointer size: $Unexpected register: $Unexpected scratch register: $Unexpected size of immediate: $byte$dword$eax$invalid map<K, T> key$mov$qword$r14$r15$rax$word
API String ID: 0-2329226126
Opcode ID: e4913e3f7c81bce9eb63305a9288cbaf464a3cb72b911a752923a3d73bd4d46f
Instruction ID: 6837d8f4cb3f89eb8151746573d3559d7a24ce8b9d739519a7dca4338bd09e14
Opcode Fuzzy Hash: e4913e3f7c81bce9eb63305a9288cbaf464a3cb72b911a752923a3d73bd4d46f
Instruction Fuzzy Hash: D5D271B2A18BC689EB359F24F8443D92761FB557A8F50A221DA6C077DBDB78C781C340

Function 00000137C155A5AD Relevance: 13.9, Strings: 9, Instructions: 2667COMMON

Download Yara Rule

Strings

status, xrefs: 00000137C155BA47
exists, xrefs: 00000137C155CB87, 00000137C155CBA2, 00000137C155D687
users, xrefs: 00000137C155AF42
config, xrefs: 00000137C155A9BD
directory_iterator::directory_iterator, xrefs: 00000137C155CBF4, 00000137C155D6A3
content, xrefs: 00000137C155A87F, 00000137C155AC07, 00000137C155B524, 00000137C155C782, 00000137C155D36F
files, xrefs: 00000137C155C905
filename, xrefs: 00000137C155A826, 00000137C155ABAE, 00000137C155B442, 00000137C155C609, 00000137C155D1C9
key, xrefs: 00000137C155C00D, 00000137C155C1ED

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: config$content$directory_iterator::directory_iterator$exists$filename$files$key$status$users
API String ID: 3645842244-2219949686
Opcode ID: 4f65c97d81405078f28492ed8e8c25073be91bbdf34d7d7fe8dd364cd371815b
Instruction ID: f362d17578d320f59ddccc6f97a82ae730b5e4145b1eb16063014fb1ccbd7c37
Opcode Fuzzy Hash: 4f65c97d81405078f28492ed8e8c25073be91bbdf34d7d7fe8dd364cd371815b
Instruction Fuzzy Hash: 4C537CB2614BC589DB308F24E8943DD63A1F785798F406226EA9D4BBDAEF74C784C340

Function 00000137C15D0350 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000137C15C1208: GetLastError.KERNEL32 ref: 00000137C15C1217
Part of subcall function 00000137C15C1208: FlsGetValue.KERNEL32 ref: 00000137C15C122C
Part of subcall function 00000137C15C1208: SetLastError.KERNEL32 ref: 00000137C15C12B7

TranslateName.LIBCMT ref: 00000137C15D03BA
TranslateName.LIBCMT ref: 00000137C15D03F5
GetACP.KERNEL32 ref: 00000137C15D043C
IsValidCodePage.KERNEL32 ref: 00000137C15D0474
GetLocaleInfoW.KERNEL32 ref: 00000137C15D0631

Strings

utf8, xrefs: 00000137C15D0558

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 8c84162eab8dbe6ad326fd3655602cdebf6bcd3c6b83614ec67febf4e5201166
Instruction ID: 216a9fd9e553f8b4515b912c23785c8061a0725db01dff678f0036e93a8a092c
Opcode Fuzzy Hash: 8c84162eab8dbe6ad326fd3655602cdebf6bcd3c6b83614ec67febf4e5201166
Instruction Fuzzy Hash: 2D91AEB230874286EB74AF21F6517E923A4E788B80F84A132DE69477C7EB78C751C751

Function 00000137C15D0D98 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000137C15C1208: GetLastError.KERNEL32 ref: 00000137C15C1217
Part of subcall function 00000137C15C1208: FlsGetValue.KERNEL32 ref: 00000137C15C122C
Part of subcall function 00000137C15C1208: SetLastError.KERNEL32 ref: 00000137C15C12B7

Part of subcall function 00000137C15C1208: FlsSetValue.KERNEL32 ref: 00000137C15C124D
Part of subcall function 00000137C15C1208: FlsGetValue.KERNEL32 ref: 00000137C15C12ED

GetUserDefaultLCID.KERNEL32 ref: 00000137C15D0F08

Part of subcall function 00000137C15C1208: FlsSetValue.KERNEL32 ref: 00000137C15C127A
Part of subcall function 00000137C15C1208: FlsSetValue.KERNEL32 ref: 00000137C15C128B
Part of subcall function 00000137C15C1208: FlsSetValue.KERNEL32 ref: 00000137C15C129C
Part of subcall function 00000137C15C1208: FlsSetValue.KERNEL32 ref: 00000137C15C130C
Part of subcall function 00000137C15C1208: FlsSetValue.KERNEL32 ref: 00000137C15C1334

EnumSystemLocalesW.KERNEL32 ref: 00000137C15D0EEF
ProcessCodePage.LIBCMT ref: 00000137C15D0F32
IsValidCodePage.KERNEL32 ref: 00000137C15D0F44
IsValidLocale.KERNEL32 ref: 00000137C15D0F5A
GetLocaleInfoW.KERNEL32 ref: 00000137C15D0FB6
GetLocaleInfoW.KERNEL32 ref: 00000137C15D0FD2

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: d7af4cb43e3a2f5a08089ec48a14d498971702225374197e96c623aa53a81e73
Instruction ID: 48b6457295352d5a23293bb65eb704ea0ca7729ff785eb0e395f5fa4d6bb800c
Opcode Fuzzy Hash: d7af4cb43e3a2f5a08089ec48a14d498971702225374197e96c623aa53a81e73
Instruction Fuzzy Hash: 6B71A9B27086528AFB30EF61F9507EC27A0FB48B44F946136CA29577D6EB38CA45C350

Function 00000137C15875D0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000137C1587784
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C1587792
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C1587A15
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C1587A23

Strings

value, xrefs: 00000137C15876AA, 00000137C1587943

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: bea37c7a5af2fa83b11a7e32be34454d174ccdec4fccbbb63c090e10dd263943
Instruction ID: d00bfce6c4021f21ed584928f8e2c305b991eae144158fc16bcceee31316849b
Opcode Fuzzy Hash: bea37c7a5af2fa83b11a7e32be34454d174ccdec4fccbbb63c090e10dd263943
Instruction Fuzzy Hash: 750281B2628BC189FB20DB74F4403DD6761E7857A4F506225FAAD17BEADF68C285C700

Function 00000137C160DBBC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000137C160DC1D
IsDebuggerPresent.KERNEL32 ref: 00000137C160DC35
OutputDebugStringW.KERNEL32 ref: 00000137C160DC46

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000137C160DC3F

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 054003f83320035adec44d53329f05feb58a978b0ff87314a16bb39900f58930
Instruction ID: ccc13e5f782afc4dcb244d66f34f13d80f02a8d6849dc3a219d7b069dad188cc
Opcode Fuzzy Hash: 054003f83320035adec44d53329f05feb58a978b0ff87314a16bb39900f58930
Instruction Fuzzy Hash: 17115EB2214B8297F724DB22FA543E933A4F744345F40A139CB4983AA5EF78D2B4C710

Function 00000137C1552C90 Relevance: 7.0, Strings: 5, Instructions: 747COMMON

Download Yara Rule

Strings

status, xrefs: 00000137C1553908, 00000137C155391E
exists, xrefs: 00000137C15538D6
directory_iterator::directory_iterator, xrefs: 00000137C15538F2, 00000137C1553942
content, xrefs: 00000137C15532F6
filename, xrefs: 00000137C155323E

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3645842244-3429737954
Opcode ID: 0b60540de1f8f33b6a41af72efedf3e174b25da4bc158924caf6aced35330ebb
Instruction ID: 188d0b223f3398e33170b004aa4d8cbc093924454e62955583b6a3fc6a9dfb1e
Opcode Fuzzy Hash: 0b60540de1f8f33b6a41af72efedf3e174b25da4bc158924caf6aced35330ebb
Instruction Fuzzy Hash: 58728FB2619BC685EB718F25F8903DD6360F789798F54A221EA5D47BEAEF34C644C300

Function 00000137C15CADF4 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C15CB22A
_get_daylight.LIBCMT ref: 00000137C15CB2C5
_get_daylight.LIBCMT ref: 00000137C15CB2DE

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 47d861683341f54d3090551517d3d7bb1a628ba7c8a4dca3f9e571835d33f049
Instruction ID: d31cc93b51b8d2be67c6838a3dcf3379adb556547f0a7a570745be352d1c5b9c
Opcode Fuzzy Hash: 47d861683341f54d3090551517d3d7bb1a628ba7c8a4dca3f9e571835d33f049
Instruction Fuzzy Hash: 7B92D3B6A0864686EB74CF24F4603EE37A6F7987C4F14A125DB8507BD6DB39CA10C720

Function 00000137C15AC090 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000137C15AC273

Strings

out_of_range, xrefs: 00000137C15AC102
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00000137C15AC39F

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$out_of_range
API String ID: 592178966-2497706888
Opcode ID: 6594c139335a1207bc39d654f26e50ae82b368122471accea4e33488c68bf5a0
Instruction ID: 6d92ce0b1a0f96c97b67e27f95be8bdb714cf5f1768b55cb8bd643f8d7fdb3ba
Opcode Fuzzy Hash: 6594c139335a1207bc39d654f26e50ae82b368122471accea4e33488c68bf5a0
Instruction Fuzzy Hash: 57A1D5B2B58B8185EB20CB75F4513EC2361E755B98F50A222EA5D17BDADA39C395C300

Function 00000137C158BE16 Relevance: 5.4, Strings: 4, Instructions: 404COMMON

Download Yara Rule

Strings

object separator, xrefs: 00000137C158C44E
array, xrefs: 00000137C158C2E4
object, xrefs: 00000137C158C399
object key, xrefs: 00000137C158C503

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: cac0fb1ac0fe51cd7a836275357f69c5a671b813984feaa0d67feb6f554065be
Instruction ID: d33b32f39c6c18f1d8c740b17f58459ff1f1e2ca0f6cabe5057cf8dff38ed294
Opcode Fuzzy Hash: cac0fb1ac0fe51cd7a836275357f69c5a671b813984feaa0d67feb6f554065be
Instruction Fuzzy Hash: 7B0270B2668A8696FA20DB35F4403ED2361FB96784F807622EA4957BDBDF34C745C340

Function 00000137C15E1BC0 Relevance: 5.4, Strings: 4, Instructions: 370COMMON

Download Yara Rule

Strings

ret , xrefs: 00000137C15E1E67, 00000137C15E1ED4, 00000137C15E2009
xchg [rsp], rax, xrefs: 00000137C15E1E0F
mov rax, , xrefs: 00000137C15E1C68, 00000137C15E1CD5
push rax, xrefs: 00000137C15E1C12

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: mov rax, $push rax$ret $xchg [rsp], rax
API String ID: 0-2795999732
Opcode ID: 5bf22ef19cf4914604e73297da6a713070f32bb81a0068465cb6c2db6ca133e5
Instruction ID: 8c8f9292261008cb7e18c16c07c57e51e8fdd87683d2a2d027f28a2977b4df86
Opcode Fuzzy Hash: 5bf22ef19cf4914604e73297da6a713070f32bb81a0068465cb6c2db6ca133e5
Instruction Fuzzy Hash: EBE1B0B2B18A8186FB24DB65F4443DD6361F746B98F40A621DE6C17BDADF78C295C300

Function 00000137C160B1A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000137C160B1C6
FormatMessageA.KERNEL32 ref: 00000137C160B1F9

Strings

!x-sys-default-locale, xrefs: 00000137C160B1B9

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: d44032de10bca517d3cc3a61524fc6b25f9580e9f75d891d10e8f21147b91806
Instruction ID: 84a1cca79a187de49f358adbb1d7a17c4271a5731860a1940adaa4a4ca35134d
Opcode Fuzzy Hash: d44032de10bca517d3cc3a61524fc6b25f9580e9f75d891d10e8f21147b91806
Instruction Fuzzy Hash: BD01D2B271878282E7318B22F4107EEA7A2F388795F44D025DA4566AD8CF3CCA00C704

Function 00000137C15B6DF0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00000137C15B6E56
memcpy_s.LIBCPMT ref: 00000137C15B6E81

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction ID: e0616f830c2a242310edc663889cdc613ff7d9385f3ae660bbac81d49475d8de
Opcode Fuzzy Hash: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction Fuzzy Hash: 0CC1D3B27186868BEB34CF59B1447AAB7A1F394B84F44A135DF4A437C5D739EA01CB40

Function 00000137C15935A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

AMOgDG3lhu7DF2W4iR51qF/HYNI+c6FvzfEhvc4rsj8=, xrefs: 00000137C1593649
port, xrefs: 00000137C159425F
9B7go21yYlc=, xrefs: 00000137C15936D1

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: 9B7go21yYlc=$AMOgDG3lhu7DF2W4iR51qF/HYNI+c6FvzfEhvc4rsj8=$port
API String ID: 0-1214220131
Opcode ID: f202b5480f5edeab80a64d3c2bf4c237b46135661f566f1c9477444b0c16fb94
Instruction ID: 326bbaf559e6fa6425d38ccb5cd24908c4780124639c095a80a1141a24633785
Opcode Fuzzy Hash: f202b5480f5edeab80a64d3c2bf4c237b46135661f566f1c9477444b0c16fb94
Instruction Fuzzy Hash: 44724DB2629BC581D670CB25F4803DAB3A5F799784F106215EBCD13B9ADF78C295CB40

Function 00000137C15EBC80 Relevance: 4.4, Strings: 3, Instructions: 633COMMON

Download Yara Rule

Strings

Original function:, xrefs: 00000137C15EBC8C
m_fnAddress: , xrefs: 00000137C15EBC8E
invalid unordered_map<K, T> key, xrefs: 00000137C15EC5D4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: Original function:$invalid unordered_map<K, T> key$m_fnAddress:
API String ID: 0-1941141636
Opcode ID: 934ecb9ed95a5f0f2fe39fd119902ebdf6c4770010a0744732a6cf2fae742d2b
Instruction ID: 8104cb63babff75322219b14a66bed7fd68376fd3d08c75fa39edf9e06e06bc8
Opcode Fuzzy Hash: 934ecb9ed95a5f0f2fe39fd119902ebdf6c4770010a0744732a6cf2fae742d2b
Instruction Fuzzy Hash: 7142D4B3B1978545EE20CB65F4543ED6761FB497E4F14A226EEAD47BDADA3CC2808300

Function 00000137C1558B60 Relevance: 3.8, Strings: 2, Instructions: 1345COMMON

Download Yara Rule

Strings

exists, xrefs: 00000137C155A128
Software, xrefs: 00000137C1558FDE, 00000137C15591B6

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 8a1605657a505301c2b7c80c423916a9051de3d5e83c92da7cc6b96be4c61918
Instruction ID: 11a99964f79f20c1881891102a74b0bf45971d7ce2d86b0c6e46fd31cdc32649
Opcode Fuzzy Hash: 8a1605657a505301c2b7c80c423916a9051de3d5e83c92da7cc6b96be4c61918
Instruction Fuzzy Hash: 3AD25EB2614BC58AEB21CF25E8503DD73A0F799798F106625EA9D17BDADF78C680C340

Function 00000137C1570E80 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1571064

Strings

conditional not closed, xrefs: 00000137C157101E, 00000137C1571041

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: conditional not closed
API String ID: 118556049-2481790218
Opcode ID: 1c60a9c5d3a36f4930e48f451563fee15543535cbf0c989a7f65713a5c288c6f
Instruction ID: 103122e19dceb74123374f400bf8f1f354d5c2cfa8c5850c38ef061cec09190c
Opcode Fuzzy Hash: 1c60a9c5d3a36f4930e48f451563fee15543535cbf0c989a7f65713a5c288c6f
Instruction Fuzzy Hash: 10D18FB2618B8684EB30CF21F8413ED77A5F755784F546226DA4807B9ADF74C790C340

Function 00000137C15C5418 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00000137C15C548C

Strings

GetLocaleInfoEx, xrefs: 00000137C15C5434, 00000137C15C5445

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: ccc1f16d2b9fc2463dee01d2f619e68b1c413d3b13c2f6d01cda35fd49cc1089
Instruction ID: 6bc04a5ef08c16f24849371caeddf1910c4e42f625dae79462e72a26e7f12b0e
Opcode Fuzzy Hash: ccc1f16d2b9fc2463dee01d2f619e68b1c413d3b13c2f6d01cda35fd49cc1089
Instruction Fuzzy Hash: 7E018B71708A41C5E7549F56B4507DAE760FB98BD0F94A036DE49137DACF38C645C380

Function 00000137C1578150 Relevance: 3.5, APIs: 2, Instructions: 491COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15781CA
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C157825B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6457c21683431f40fc46ce0097663e54508b7ea26b05d588e75e728b20c3ee12
Instruction ID: 28d840b41bdf3e62ff1cd1b5281c4682c3fedc96abd07266e2b3bd2734527b78
Opcode Fuzzy Hash: 6457c21683431f40fc46ce0097663e54508b7ea26b05d588e75e728b20c3ee12
Instruction Fuzzy Hash: 1B12BFB2729B8285EB20CB61F4413DD6361E748B98F546626DE6D177CAEF34C6A1C380

Function 00000137C1572F80 Relevance: 3.4, APIs: 2, Instructions: 439COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C157312A
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1573305

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: cfdb73c61837a0fb912f7992e28a7a00a8de2d2abffdc0bd83ade3022f386902
Instruction ID: 76505f54922b462ad78a3c3685a3f0570299d496d7a2925e3c116d241c56a69a
Opcode Fuzzy Hash: cfdb73c61837a0fb912f7992e28a7a00a8de2d2abffdc0bd83ade3022f386902
Instruction Fuzzy Hash: 6202DFB2229B8581EAA0CB15F4453AD77A5F748BE0F249625EFAD077D6DF38C291C340

Function 00000137C15C8B08 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00000137C15C8D57
RaiseException.KERNEL32 ref: 00000137C15C8D68

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a218957482b48b590648b3e16ace9b7ac7afc45119c2de734ba3a03728b764a2
Instruction ID: edd732512aa72555e3d3e086ae752512446ff65a8b673263d36085b91a5c1b2f
Opcode Fuzzy Hash: a218957482b48b590648b3e16ace9b7ac7afc45119c2de734ba3a03728b764a2
Instruction Fuzzy Hash: 2DB17EB3200B898BEB65CF29E85639C3BA0F348B48F189921DB5D877E5CB39C561C710

Function 00000137C15A3BA0 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 00000137C15A3CB7
EnumDisplayDevicesW.USER32 ref: 00000137C15A3D5B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: b169a16e2751d1bab4a8afafb00c67296eacbfb3c4b12a000734d39e14261286
Instruction ID: 220ece0271aac3b95657f3fb9ae0aef169cde26c3fc714f97e131b3ade2d2fcc
Opcode Fuzzy Hash: b169a16e2751d1bab4a8afafb00c67296eacbfb3c4b12a000734d39e14261286
Instruction Fuzzy Hash: 2481B172618B8586E760CF21F8443EE77A4F388798F506225EE9D17B99DF78C681C740

Function 00000137C15950D0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 00000137C1595128
LocalFree.KERNEL32 ref: 00000137C15951BA

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 52960f018f6b1f12d67629b669ec63dfa0ea14dc44592252fcec820f30678a9d
Instruction ID: ff0e43e745446dde7a820bac1a3eda03416cf995ded188cf65ba93df7eb7354d
Opcode Fuzzy Hash: 52960f018f6b1f12d67629b669ec63dfa0ea14dc44592252fcec820f30678a9d
Instruction Fuzzy Hash: 57415573618B81CAE3208F74E4503DD37A4F75878CF445229EB8916E8ADB79C6A4C744

Function 00000137C15EFB20 Relevance: 3.0, Strings: 2, Instructions: 492COMMON

Download Yara Rule

Strings

rel, xrefs: 00000137C15EFDE4
abs, xrefs: 00000137C15EFDD4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: abs$rel
API String ID: 0-1867029159
Opcode ID: a473d4a40322626fd3db14bdbe02dfedb8dc11f491bf41f379a2da7ce227cca6
Instruction ID: 8251ef47942dab4fde7176d11c9e78374508175015ebc2b89610fb9355f6f024
Opcode Fuzzy Hash: a473d4a40322626fd3db14bdbe02dfedb8dc11f491bf41f379a2da7ce227cca6
Instruction Fuzzy Hash: C61245B2F286568AFB708F68F8407ED37A2E709748F44A436DE55577C6CA39CA42C740

Function 00000137C15CBE30 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

a/p, xrefs: 00000137C15CC14A
am/pm, xrefs: 00000137C15CC0DF

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: e44e7f5a9793515cbfde24193da60f420245beee8b2814de827b0476138bf784
Instruction ID: 3761309175420333c7e8fd921d31e16f2fef3acf763fe87419285b566f6babcf
Opcode Fuzzy Hash: e44e7f5a9793515cbfde24193da60f420245beee8b2814de827b0476138bf784
Instruction Fuzzy Hash: DDE131B2608642C5EB74CF69B1747FD23A1F759B84F546122EA4A03BC6DB38CB41D320

Function 00000137C158FE70 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C159018B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8ae5d891fff4fd70b8494eedb539a1e86762384cd7f60f1fd3b7b5a11bdc8181
Instruction ID: f24226770bb42292731bd4227f1b60deae3732ee4da57d7f78f07b392a3f2189
Opcode Fuzzy Hash: 8ae5d891fff4fd70b8494eedb539a1e86762384cd7f60f1fd3b7b5a11bdc8181
Instruction Fuzzy Hash: 95A19CB2619B9989FB10CB69E4803EC37B0F359B48F549826DF8D57B86DB39C291C350

Function 00000137C158FB50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C158FE64

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: af48ab863644eba9c53a3bcbf901b2ac65b0de9835582d2f1dd6a355bb2245ea
Instruction ID: adb29389a5973972b67db87dc9179e7c11e6144ebda9bae2b374d97c41cad18a
Opcode Fuzzy Hash: af48ab863644eba9c53a3bcbf901b2ac65b0de9835582d2f1dd6a355bb2245ea
Instruction Fuzzy Hash: 4DA19872609B9989FB10CB6AE4803EC37B0F359B48F549426CF8D57B8ADB39C291C350

Function 00000137C158F200 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C158F4F8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 652caa62f8e7a2070d9f04c2b9ed4b1064606c6af98949e31824a65c682d9d9f
Instruction ID: 965a59dbb5f6a9d7ef216b580312e7a0c9819b32d55ca8a99a1b67b391edf0cb
Opcode Fuzzy Hash: 652caa62f8e7a2070d9f04c2b9ed4b1064606c6af98949e31824a65c682d9d9f
Instruction Fuzzy Hash: 8EA169B2619B9989FB10CBA9E4803EC27B0F359B48F545466CF8E57B96DB39C290C350

Function 00000137C15901A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1590498

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4f5dff6b216078917b13afae14288872d1f6d87edc70049025d931af356cc428
Instruction ID: 19b16f702868225825f2734969ba2da73996df09cbe107c9051ad0394e9f767e
Opcode Fuzzy Hash: 4f5dff6b216078917b13afae14288872d1f6d87edc70049025d931af356cc428
Instruction Fuzzy Hash: 61A1ADB2705B9989EB10CBA9E4803EC37B4F355B48F549826CF8D53B96DB39C291C340

Function 00000137C15C4ED8 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00000137C15C4F27

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ed705c37d69ef8013e8692d4cdd39cd770c57f58848f00780f6b4190c1d9d426
Instruction ID: fe854e79cfa150486553f18cea258332726cd5c52c45691c383d8e6e63801e8f
Opcode Fuzzy Hash: ed705c37d69ef8013e8692d4cdd39cd770c57f58848f00780f6b4190c1d9d426
Instruction Fuzzy Hash: 6AF031B2308B8583E714DF25F8906D523A1F798B80F54B039DA49833A5DE38C660C740

Function 00000137C15EAB70 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

invalid unordered_map<K, T> key, xrefs: 00000137C15EADE7

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: invalid unordered_map<K, T> key
API String ID: 0-353222475
Opcode ID: 3816611a46f99d454c894934d88facfdf03a6d509af848790ad9a93ba470a137
Instruction ID: eaf91f5f9790f7623efcdf0016fc5b546506f19c52fd9eca6adaa82bde75e381
Opcode Fuzzy Hash: 3816611a46f99d454c894934d88facfdf03a6d509af848790ad9a93ba470a137
Instruction Fuzzy Hash: AC81EAB371464545FF248B31F4153ECA7A5E789BC8F45E162EA9D0BBD9DA3CC6418340

Function 00000137C1525DC0 Relevance: 1.0, Instructions: 961COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fec21f9ddb32210f6b5e969e071971b159482b6e2fd4f4b72927dbf668d3f10
Instruction ID: 02628cc21058fc271d6a10a62d8dc126483350deaeb37020b2e0bfedb94ff5d3
Opcode Fuzzy Hash: 5fec21f9ddb32210f6b5e969e071971b159482b6e2fd4f4b72927dbf668d3f10
Instruction Fuzzy Hash: 0BC2BEB2525FC889D7B18F39EC812DD73A8F75878CF109615EB8C5AB59EF3082589348

Function 00000137C160E4B0 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d4d767bbbaaf6fc642392a77769fc2c7124bc08782bf1337f65d91400a68ab
Instruction ID: c1a6ff24f05f82d90465cc28d710d4a4dcda2eed0657d5046fad20c73940a7d5
Opcode Fuzzy Hash: b7d4d767bbbaaf6fc642392a77769fc2c7124bc08782bf1337f65d91400a68ab
Instruction Fuzzy Hash: 36521EB2629E66C9F6738F36B9117957724BB563C0F01E723E80A77AD0DF68C6428704

Function 00000137C15792D0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47d2fc46064dab5907b35485465ac6e09d969a0ee3f7e69edd6212c471c0128
Instruction ID: fd5dbc15911e3acccaea89aad7d012c162eca97517acd3eb790f482f41759d06
Opcode Fuzzy Hash: f47d2fc46064dab5907b35485465ac6e09d969a0ee3f7e69edd6212c471c0128
Instruction Fuzzy Hash: AAC1E4B373969587EB66CF12F9456A9B762F3D4BE0F45E120DA4A07B84C738CA06C740

Function 00000137C15C1CB8 Relevance: .4, Instructions: 356COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 8ac31fa04c19b1e2fbc0069e105ec20734bcc7f02028cf51b506effd250d55be
Instruction ID: 0b2b4cf1089e077d007313ddb030f4f766e3d438d7d28c44a2d06e7ce8b3930b
Opcode Fuzzy Hash: 8ac31fa04c19b1e2fbc0069e105ec20734bcc7f02028cf51b506effd250d55be
Instruction Fuzzy Hash: 10E1E6B630868285EB709F61B8603EA27A1F799788F406036DE4A877D7DF38C641C720

Function 00000137C1592CB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: 11ba70e4c0fa0f29962ab36aae559360458242e50bcfae837547d40307466757
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: 73C1C3B3A146948BE355CF2DD40195D7BE0F398B84F40A629EB56C3B01E778E9A5CF80

Function 00000137C1528000 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf60a5878d10fb45bb922aa4434284bfb4a8850ce500248e9bf54e3d3a20baed
Instruction ID: 0999d63a9413dc47304e55c6285c007da81074fefcf498ca7691d0675385bf8f
Opcode Fuzzy Hash: bf60a5878d10fb45bb922aa4434284bfb4a8850ce500248e9bf54e3d3a20baed
Instruction Fuzzy Hash: B6B1F672919FC48AD7108FA9E88029DB7B5F7997A8F101325EACC63F59EB78C254C740

Function 00000137C156DDA0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197750e4aaad263fb16452bdc9eff378dcd9ed9655da37c4e9a39dd39b5568c7
Instruction ID: 7c57af1cb97ebc4b308cc7ffc01262dae75f5a9a2761b7edbea20f077c576087
Opcode Fuzzy Hash: 197750e4aaad263fb16452bdc9eff378dcd9ed9655da37c4e9a39dd39b5568c7
Instruction Fuzzy Hash: 9161F772714BC982DF20CB19F4452E9A361F3697D4F54A621EBDD47B89EB78D680C380

Function 00000137C1611BCC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 96dee636877c4981823ff604cc05051f0ce0167f6762f4337eb515c1ee7efdad
Instruction ID: 32bab238d15b5d41d5a486fa2476ae628d672ed43093e1468391dd1dac9bfc60
Opcode Fuzzy Hash: 96dee636877c4981823ff604cc05051f0ce0167f6762f4337eb515c1ee7efdad
Instruction Fuzzy Hash: F96146B3B0C69242F7749B78B4507FD66E0A742370F7A2239EA2597BC5DE38CA008700

Function 00000137C15930F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7712bce75c303a6c128dfa0d45a2675bbe9045de200c46ed45cf77d95598a9a8
Instruction ID: 12ad1986d35088c72be9d5883a370c3fe7d3c7bab89447c82fd8ae0ef1f5cef1
Opcode Fuzzy Hash: 7712bce75c303a6c128dfa0d45a2675bbe9045de200c46ed45cf77d95598a9a8
Instruction Fuzzy Hash: C461E02321E2C48FD31EDF7C589106D7F61D3A7908788469DEAC5EBB4BC504C91ACBA6

Function 00000137C15B8ABC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: b3a358be15adbbbf658b13cacadaa74f0453237e784d660d2064865a45487068
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 465170F6229A5186E775CB29F0543A837A0F344B98F38B121CE495B7D6CB36DA63C740

Function 00000137C15B8CC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 16c8e2a65118877098734f635e567e57ed5c3bbf14dfe82423b4720a92a9f34d
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 095193B6218A518AE735CB29F04039C37A0E359F58F647126CE49177EAC736DE63C740

Function 00000137C15B8EC4 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: c80f5cd42d77591abe612be2c347d1d1b5802a73bdc07672726ed344b8e92b72
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 44518FF6618A5686E734CB29F0443A837A1E345B58F286121DF89577E6C736CA53C780

Function 00000137C15D32E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 16bb59dd3f2381f650c05178f22e37e978b57fc9bade44bc83188e9bc5653b9e
Instruction ID: 16a503855967d3c9e2ff69c9ae7b5d3c1fe361d2953f820a53fdfda0c26a95e9
Opcode Fuzzy Hash: 16bb59dd3f2381f650c05178f22e37e978b57fc9bade44bc83188e9bc5653b9e
Instruction Fuzzy Hash: 1441C5B2314A5581EF54CF6AFA5829973A1B348FD0F49A136DE5D87B95DE3CC1528300

Function 00000137C15BF384 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f002881efd8788ee020ebe9b5287b6ed930f04522113ec59c3e42dca390c035a
Instruction ID: baaefacf86d104d62c3de27f8a0b63a3ad2c9e27c1daa9f5ddca922263e46cf9
Opcode Fuzzy Hash: f002881efd8788ee020ebe9b5287b6ed930f04522113ec59c3e42dca390c035a
Instruction Fuzzy Hash: F4319CF271C1538AF6B9DA29B5557F91642E782300F78B5B3CD0102BDBCA3B8B469601

Function 00000137C15BF268 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3cb59ec0bf7899867bf851bf667cf51092c67ae8703a3e64bec9bc61aabe119
Instruction ID: f6ccbabee3da339aadf4ace46eaa14128e3939df02e287be26f47bf7437bd7de
Opcode Fuzzy Hash: d3cb59ec0bf7899867bf851bf667cf51092c67ae8703a3e64bec9bc61aabe119
Instruction Fuzzy Hash: 7D319CB625D10386FAB9DA2DB955BFD6142E782340F68B0B3CD0102FEBC923CB469601

Function 00000137C160DB94 Relevance: .0, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0632ab2d35daa1aa6ecad7cd93d8250a39c75d3d38a000361c0797779c2a3516
Instruction ID: fab0e6f3857d4e0713c96821619ca3a46aaa9bc385add9bc4d51b9305d5bd137
Opcode Fuzzy Hash: 0632ab2d35daa1aa6ecad7cd93d8250a39c75d3d38a000361c0797779c2a3516
Instruction Fuzzy Hash: 99F062E7B0EFC345F27643656D263881BD0A756B20FD862AEC668122D6DE1217019301

Function 00000137C1632310 Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea83fc18505f2aec0aeadda38b4f7302af226c24597ec8790b9032a9d7608d4a
Instruction ID: 8ee3c9bd15cf74197865e33134f7253ef63ddf21a972ea0a63d3cd01bbc44d73
Opcode Fuzzy Hash: ea83fc18505f2aec0aeadda38b4f7302af226c24597ec8790b9032a9d7608d4a
Instruction Fuzzy Hash: 94F030DB60EFC305F2B241A81E263891FD0A753B34F9C139ECB70162D799536A05A241

Function 00000137C16323D0 Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929bba8d3d266afbbdf6c29b8c3aac0e9ceb9f83f4d3d304699c092e89afd05b
Instruction ID: 64a12803d01da4f552c37d311ea8c439253171c1c02508300c7438b5370005fa
Opcode Fuzzy Hash: 929bba8d3d266afbbdf6c29b8c3aac0e9ceb9f83f4d3d304699c092e89afd05b
Instruction Fuzzy Hash: 27F0E5DB90DEC201F2A200681E2A39A1FE14B53B74F8D933ECF30172C789171E06A301

Function 00000137C16320F8 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d86e3ee49bece079fed1a8dafc567eba119ae3c71a3d36371c2989893f02372
Instruction ID: 62b65cd507f7fc6337e7e282158079c2d2517fe4007b7e964c035561b45bb801
Opcode Fuzzy Hash: 1d86e3ee49bece079fed1a8dafc567eba119ae3c71a3d36371c2989893f02372
Instruction Fuzzy Hash:

Function 00000137C1591C30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000137C1591C86
Process32FirstW.KERNEL32 ref: 00000137C1591CCA
Process32NextW.KERNEL32 ref: 00000137C1591CDF
OpenProcess.KERNEL32 ref: 00000137C1591D1B
OpenProcessToken.ADVAPI32 ref: 00000137C1591D42
GetTokenInformation.ADVAPI32 ref: 00000137C1591D6E
GetLastError.KERNEL32 ref: 00000137C1591D7C
GetTokenInformation.ADVAPI32 ref: 00000137C1591DBC
ConvertSidToStringSidA.ADVAPI32 ref: 00000137C1591DD3
CloseHandle.KERNEL32 ref: 00000137C1591E46
CloseHandle.KERNEL32 ref: 00000137C1591E51
CloseHandle.KERNEL32 ref: 00000137C1591EB6
Process32NextW.KERNEL32 ref: 00000137C1591EC3
CloseHandle.KERNEL32 ref: 00000137C1591EE9
CloseHandle.KERNEL32 ref: 00000137C1591EF2
CloseHandle.KERNEL32 ref: 00000137C1591F07

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: f42cf85e0bce5153215c9d7babbbe699e3c4e8a243701d2dfd245effa3a2a78e
Instruction ID: b2e09350f889a14256480f4487213437c460cd5482a359bcb43b6210d7552ada
Opcode Fuzzy Hash: f42cf85e0bce5153215c9d7babbbe699e3c4e8a243701d2dfd245effa3a2a78e
Instruction Fuzzy Hash: D881B276218B9286E720DB22F94039EB7A5F789B94F406135EF8953BD8DF78C645C700

Function 00000137C15C1208 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000137C15C1217
FlsGetValue.KERNEL32 ref: 00000137C15C122C
FlsSetValue.KERNEL32 ref: 00000137C15C124D
FlsSetValue.KERNEL32 ref: 00000137C15C127A
FlsSetValue.KERNEL32 ref: 00000137C15C128B
FlsSetValue.KERNEL32 ref: 00000137C15C129C
SetLastError.KERNEL32 ref: 00000137C15C12B7
FlsGetValue.KERNEL32 ref: 00000137C15C12ED
FlsSetValue.KERNEL32 ref: 00000137C15C130C

Part of subcall function 00000137C15C4E28: HeapAlloc.KERNEL32 ref: 00000137C15C4E7D

FlsSetValue.KERNEL32 ref: 00000137C15C1334

Part of subcall function 00000137C15C47C0: HeapFree.KERNEL32 ref: 00000137C15C47D6
Part of subcall function 00000137C15C47C0: GetLastError.KERNEL32 ref: 00000137C15C47E0

FlsSetValue.KERNEL32 ref: 00000137C15C1345
FlsSetValue.KERNEL32 ref: 00000137C15C1356

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 96ea29e5fe9229b6a086437c10f391821abb4ac2bcdf3a5953572b5816527937
Instruction ID: 2343ad0dccaaf7b39dc4b74df1fbcbf4dc2c1ac96a5462651b7927f641e13496
Opcode Fuzzy Hash: 96ea29e5fe9229b6a086437c10f391821abb4ac2bcdf3a5953572b5816527937
Instruction Fuzzy Hash: FD4140F430C20282FA786F7179B17ED52925B4EBB4F943734D93646BC7DE688612C220

Function 00000137C1597B00 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000137C1597B7D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000137C1597BC5
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1597D41
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1597D54
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1597D5A

Strings

bad locale name, xrefs: 00000137C1597D47
false, xrefs: 00000137C1597C4D
true, xrefs: 00000137C1597C7C

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: cd099738ed1609ff69ed68634f856e852bd492813bf82195bd31ad29d5933a25
Instruction ID: 15edb438a546f92e17d1f99901ef093ed5638411c77e70b30d37494ffde89848
Opcode Fuzzy Hash: cd099738ed1609ff69ed68634f856e852bd492813bf82195bd31ad29d5933a25
Instruction Fuzzy Hash: 487129B270AB418AEB21DF70F4503EC33A6EB84748F046529EE4927BDADF348612D355

Function 00000137C15C4F54 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000137C15C50D0
GetProcAddress.KERNEL32 ref: 00000137C15C50DC

Strings

ext-ms-, xrefs: 00000137C15C502D
api-ms-, xrefs: 00000137C15C501A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 719561378f0d74617f1bcdbfcfc11508aac42a575313cbdf1355d5b59e53c671
Instruction ID: f69c042553827c8048884f6dd0e21da12821c8dc9bb621cd5df4c23ed93b8177
Opcode Fuzzy Hash: 719561378f0d74617f1bcdbfcfc11508aac42a575313cbdf1355d5b59e53c671
Instruction Fuzzy Hash: 214105B1329A02C1FA35CF56B8147D62791BB49B90F896139DD09E77C9EF38C604C350

Function 00000137C1598180 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00000137C15981EB
InternetOpenUrlA.WININET ref: 00000137C1598220
InternetReadFile.WININET ref: 00000137C1598241
InternetReadFile.WININET ref: 00000137C159827F
InternetCloseHandle.WININET ref: 00000137C159828C
InternetCloseHandle.WININET ref: 00000137C1598295

Strings

File Downloader, xrefs: 00000137C15981E4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 91e744b22f357f91b51b56f9f413c7a71866174e8c47e92bf1781ef31d06db3a
Instruction ID: c12e33c01fd9acdad0dfa8e13ce3568b3da6d7f494449c62a83385969ca234de
Opcode Fuzzy Hash: 91e744b22f357f91b51b56f9f413c7a71866174e8c47e92bf1781ef31d06db3a
Instruction Fuzzy Hash: F13184B1219B8586EB208F15F9507DAB364F789BC4F446025EE8943B99DF7CC655CB00

Function 00000137C15D401C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000137C15D404D
GetLastError.KERNEL32 ref: 00000137C15D4059
CloseHandle.KERNEL32 ref: 00000137C15D4071
CreateFileW.KERNEL32 ref: 00000137C15D409C
WriteConsoleW.KERNEL32 ref: 00000137C15D40BB

Strings

CONOUT$, xrefs: 00000137C15D407D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: d64a5614ff09383aec324552889b53812a6c5a93abf77eb905263844d90bf464
Instruction ID: 48000cead815689d3b02c8201891511883a1f2afb3b90cdf8a398144fdfae999
Opcode Fuzzy Hash: d64a5614ff09383aec324552889b53812a6c5a93abf77eb905263844d90bf464
Instruction Fuzzy Hash: 3F11C171318B8186E7609B12F85439A73A0F788FE4F402338EA5A87BE4CF78CA148744

Function 00000137C160D3F0 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000137C160D460
MultiByteToWideChar.KERNEL32 ref: 00000137C160D4FE
LCMapStringEx.KERNEL32 ref: 00000137C160D567
LCMapStringEx.KERNEL32 ref: 00000137C160D5B9
LCMapStringEx.KERNEL32 ref: 00000137C160D65E
WideCharToMultiByte.KERNEL32 ref: 00000137C160D6B8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: ab8cc68040f5ba096ca5233c2424b9e0e4952a4f01a22be492c17f84c5e0e459
Instruction ID: b1c0c948c1529d9fdfae9eaad2a5b39f0c3531382b92b1488dca0fc4edaa22ee
Opcode Fuzzy Hash: ab8cc68040f5ba096ca5233c2424b9e0e4952a4f01a22be492c17f84c5e0e459
Instruction Fuzzy Hash: D581BFB2219B4286EB308F25F9403D973E5FB44BA8F142335EA5957BD8EF38C6458704

Function 00000137C160D110 Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000137C160D161
AcquireSRWLockExclusive.KERNEL32 ref: 00000137C160D180
AcquireSRWLockExclusive.KERNEL32 ref: 00000137C160D1A2
sys_get_time.LIBCPMT ref: 00000137C160D1BD
TryAcquireSRWLockExclusive.KERNEL32 ref: 00000137C160D1E3
TryAcquireSRWLockExclusive.KERNEL32 ref: 00000137C160D1FB

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: dcaa0c5ec967c3866615ac309e3086bf37bc4396709c5386fc2d1e26bec89594
Instruction ID: 9a2b47cf234a43cafd416b35b8ead8731de7fe8fdb1eb79717a4c96b7f4649e3
Opcode Fuzzy Hash: dcaa0c5ec967c3866615ac309e3086bf37bc4396709c5386fc2d1e26bec89594
Instruction Fuzzy Hash: C5416FB2618646C6EB74CF10F4403A973B0F754B99F80A235DB99A36D9DF38CA91CB04

Function 00000137C15C1380 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000137C15C138F
FlsSetValue.KERNEL32(?,?,0000686E0EC64330,00000137C15B8599,?,?,?,?,00000137C15C4C7A,?,?,00000000,00000137C15D4FAB,?,?,?), ref: 00000137C15C13C5
FlsSetValue.KERNEL32(?,?,0000686E0EC64330,00000137C15B8599,?,?,?,?,00000137C15C4C7A,?,?,00000000,00000137C15D4FAB,?,?,?), ref: 00000137C15C13F2
FlsSetValue.KERNEL32(?,?,0000686E0EC64330,00000137C15B8599,?,?,?,?,00000137C15C4C7A,?,?,00000000,00000137C15D4FAB,?,?,?), ref: 00000137C15C1403
FlsSetValue.KERNEL32(?,?,0000686E0EC64330,00000137C15B8599,?,?,?,?,00000137C15C4C7A,?,?,00000000,00000137C15D4FAB,?,?,?), ref: 00000137C15C1414
SetLastError.KERNEL32 ref: 00000137C15C142F

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a0bc6161aae1a978bbd4e614253e214f4d4aefe8d43a9ee1fc1af19a23985539
Instruction ID: 1dfc2c1af6919d05a11825c6193d86cbd6c745e1161284c5858d0da2ecdbe456
Opcode Fuzzy Hash: a0bc6161aae1a978bbd4e614253e214f4d4aefe8d43a9ee1fc1af19a23985539
Instruction Fuzzy Hash: 66115EB030C24282F6746B717AB17AD52925B4DBB0F947734E93606BCBDE688641C220

Function 00000137C1550420 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00000137C155047F

Part of subcall function 00000137C160B290: AreFileApisANSI.KERNEL32 ref: 00000137C160B2A2

__std_exception_destroy.LIBVCRUNTIME ref: 00000137C1550727
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C15507E1

Strings

", ", xrefs: 00000137C155056D
: ", xrefs: 00000137C155053A

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 0f0a78cabc45884e6da76cca535291b853cf26a0a925827afb0c860ac207dd90
Instruction ID: 4e98be44c9842b0e398003402560ec8e9035ee534fffb81cd64de62d38683ed3
Opcode Fuzzy Hash: 0f0a78cabc45884e6da76cca535291b853cf26a0a925827afb0c860ac207dd90
Instruction Fuzzy Hash: F3B1DEB2708B4585EB20EF65F1543EC2361E745B88F50A521EE5E17BDADF34C691C380

Function 00000137C15C1448 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000137C15B3867,?,?,00000000,00000137C15B3B02,?,?,?,?,?,00000137C15B3A8E), ref: 00000137C15C1467
FlsSetValue.KERNEL32(?,?,?,00000137C15B3867,?,?,00000000,00000137C15B3B02,?,?,?,?,?,00000137C15B3A8E), ref: 00000137C15C1486
FlsSetValue.KERNEL32(?,?,?,00000137C15B3867,?,?,00000000,00000137C15B3B02,?,?,?,?,?,00000137C15B3A8E), ref: 00000137C15C14AE
FlsSetValue.KERNEL32(?,?,?,00000137C15B3867,?,?,00000000,00000137C15B3B02,?,?,?,?,?,00000137C15B3A8E), ref: 00000137C15C14BF
FlsSetValue.KERNEL32(?,?,?,00000137C15B3867,?,?,00000000,00000137C15B3B02,?,?,?,?,?,00000137C15B3A8E), ref: 00000137C15C14D0

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6151e1ab512c91417d0fd1174f99e27422c80a6c509127a811f5eac78adf5dd7
Instruction ID: 854476c56f4c20637305f9e3d693da2c9e5e7e08198d65ea88cf5e6ab751d47e
Opcode Fuzzy Hash: 6151e1ab512c91417d0fd1174f99e27422c80a6c509127a811f5eac78adf5dd7
Instruction Fuzzy Hash: 301193B030C24281FA789F657AF17E992515B4D7B0F487338E83A067CBDE6CC601C220

Function 00000137C1569230 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000137C15692A0
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000137C15692E8
_Getcoll.LIBCPMT ref: 00000137C156931C

Strings

bad locale name, xrefs: 00000137C1569421

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 88079e8517fec9cfcc7c8ac3f5039ea7a47a817c4aad07439b917c5b4a5cbb2b
Instruction ID: 31e01bfa208c42c3d4cbbcd6a6d01d72270e87cb21e941ebaf9cdf248b3418ee
Opcode Fuzzy Hash: 88079e8517fec9cfcc7c8ac3f5039ea7a47a817c4aad07439b917c5b4a5cbb2b
Instruction Fuzzy Hash: DDA18FB2706B818AEB24DFA5F4503ED33A1EB44B88F146535DA5D27BDADE34C6508384

Function 00000137C15E9020 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15E925A

Strings

$, xrefs: 00000137C15E93AF
tter, xrefs: 00000137C15E93D6
/, xrefs: 00000137C15E93B8

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: $$/$tter
API String ID: 118556049-4034128088
Opcode ID: 59d0706c9684f18f986bbfbb2b9bd9b875e919fb5ac162d87e4f66e51fc49881
Instruction ID: 963eb4de2a0b9ef438c012d61eac109ce2b31afad9c68f4f559d3f4f0cb05ccd
Opcode Fuzzy Hash: 59d0706c9684f18f986bbfbb2b9bd9b875e919fb5ac162d87e4f66e51fc49881
Instruction Fuzzy Hash: 47B1C3B2A18B8182E724DF25F4443DE73A0FB95B84F54A225EA9D43BD6DF38C691C740

Function 00000137C1610CE8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000137C1610FC7

Part of subcall function 00000137C15D3BFC: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15D3C19

Strings

ccs, xrefs: 00000137C1610F02
UTF-8, xrefs: 00000137C1610F46
UTF-16LEUNICODE, xrefs: 00000137C1610F65

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 035adfd8f30b7d3758a11a9300093ffa4a34d8b58ad662a0b6622189a8e9a0c0
Instruction ID: 698d893d57f5ca88f40b968fb6af98b3f2ab8e4b6afeb468c2ee2772d91a4633
Opcode Fuzzy Hash: 035adfd8f30b7d3758a11a9300093ffa4a34d8b58ad662a0b6622189a8e9a0c0
Instruction Fuzzy Hash: F481A0F260C342C9FF749F2AA1513E836A0A314B48F77B025DA82776D5DB39CB41A741

Function 00000137C15EA5C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15EA84A

Strings

jmp, xrefs: 00000137C15EA6BD
iret, xrefs: 00000137C15EA736
ret, xrefs: 00000137C15EA6EC

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: iret$jmp$ret
API String ID: 118556049-3663989749
Opcode ID: d76a5dc656f4d7f596f5ee0fcc0a09a96a403a642b3690bfe9655f1daab74ba9
Instruction ID: d3f5a82ab061a163bc4eaa3f0b25d60673346c7a2ad99c2c2efc0f6b1daf4e7d
Opcode Fuzzy Hash: d76a5dc656f4d7f596f5ee0fcc0a09a96a403a642b3690bfe9655f1daab74ba9
Instruction Fuzzy Hash: 4661D5B6B1C68285FE709B35F0043ED67A1EB467E0F55A632DA6A17BD7DA2CC7418300

Function 00000137C157CAB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000137C157CC90
__std_exception_destroy.LIBVCRUNTIME ref: 00000137C157CC9D

Strings

at line , xrefs: 00000137C157CB3A
, column , xrefs: 00000137C157CB68

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 3f780ef7e5359a42c46859976d2eda710d51c6f5304ee1e9230b02aa1cf7dc94
Instruction ID: 56bfa40f2dfbcde644b22a6f46c26ee19a70f43b357c389aff28e514d2d044bf
Opcode Fuzzy Hash: 3f780ef7e5359a42c46859976d2eda710d51c6f5304ee1e9230b02aa1cf7dc94
Instruction Fuzzy Hash: 0051D4B261878281EA30DB15F58139E6761F785BD4F50A221EBAC07BDBDF78C691C780

Function 00000137C154F1A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000137C154F20F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000137C154F257
_Getctype.LIBCPMT ref: 00000137C154F295

Strings

bad locale name, xrefs: 00000137C154F34E

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 5f073343040d0bdc564ba2085f01554342092d3c436d0d1b1f3e00217c640a7c
Instruction ID: 2be9ef31d9f31565f42be5953728b410956d36bb2f04d4d397c606bed6b44a53
Opcode Fuzzy Hash: 5f073343040d0bdc564ba2085f01554342092d3c436d0d1b1f3e00217c640a7c
Instruction Fuzzy Hash: 70515A7270AB418AEB21DF78F4903ED33A4EB44748F14543AEE4926B9ADF34C666C344

Function 00000137C15A45A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000137C15A462B

Strings

?, xrefs: 00000137C15A45E0

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 08843fdaf0995ee8a5d5385c394cf228dee81bfccb07a1515d0d7826f330525f
Instruction ID: b2065dae6e4f13867dd79e8ea66794d51ee0c33c6717d1f24d7a96c25b341509
Opcode Fuzzy Hash: 08843fdaf0995ee8a5d5385c394cf228dee81bfccb07a1515d0d7826f330525f
Instruction Fuzzy Hash: EB4192B261878181EB608B65F4803AAB7A0F7957D4F506225FB9943B9ADF38C294CB40

Function 00000137C160B240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000137C160B256
GetProcAddress.KERNEL32 ref: 00000137C160B266

Strings

kernel32.dll, xrefs: 00000137C160B24F
GetTempPath2W, xrefs: 00000137C160B25C

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 1486a03457541e07cc672fa27f6337fb1d4ca800d066eee7c0edc0d6007ce8ef
Instruction ID: af9666f1d60bf4bb8913a985f2b58ebde74359f537f04ff57e9cb2ec0d0644c9
Opcode Fuzzy Hash: 1486a03457541e07cc672fa27f6337fb1d4ca800d066eee7c0edc0d6007ce8ef
Instruction Fuzzy Hash: A9E012B1318B06C1EE159B15F9843A96331FB88B85F986039C91E573B4DF3CC6958700

Function 00000137C15E85D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000137C15E85DB
GetProcAddress.KERNEL32 ref: 00000137C15E85F5

Strings

VirtualAlloc2, xrefs: 00000137C15E85EB
kernelbase.dll, xrefs: 00000137C15E85D4

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 2574300362-1188699709
Opcode ID: 05473327a1975c6075b06088ed585200b6a11a07f1b9b7cf8b29158ac04d1699
Instruction ID: dff0cb745507d21217b222a85ca7e6b9d05fa8fb11be52721b777af4e88afe7b
Opcode Fuzzy Hash: 05473327a1975c6075b06088ed585200b6a11a07f1b9b7cf8b29158ac04d1699
Instruction Fuzzy Hash: 08D09EF8B06642D1ED2A9B11FD857E413A0AB58711FC9643AC60D213A4EE6C47999700

Function 00000137C1592380 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00000137C1591C30: CreateToolhelp32Snapshot.KERNEL32 ref: 00000137C1591C86
Part of subcall function 00000137C1591C30: Process32FirstW.KERNEL32 ref: 00000137C1591CCA
Part of subcall function 00000137C1591C30: Process32NextW.KERNEL32 ref: 00000137C1591CDF
Part of subcall function 00000137C1591C30: OpenProcess.KERNEL32 ref: 00000137C1591D1B
Part of subcall function 00000137C1591C30: OpenProcessToken.ADVAPI32 ref: 00000137C1591D42
Part of subcall function 00000137C1591C30: CloseHandle.KERNEL32 ref: 00000137C1591EB6
Part of subcall function 00000137C1591C30: Process32NextW.KERNEL32 ref: 00000137C1591EC3
Part of subcall function 00000137C1591C30: CloseHandle.KERNEL32 ref: 00000137C1591F07

ImpersonateLoggedOnUser.ADVAPI32 ref: 00000137C15923DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 00000137C15928C8
RevertToSelf.ADVAPI32 ref: 00000137C15928E6

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: d8b059769ea0d16e75b87ee331a722cf5fde8648986ca24bcfb81488bb9e8d1f
Instruction ID: 58f4e11b229a2291e0890fc658c1d94289bc8991a9d4921dfad4633b2f21a4ab
Opcode Fuzzy Hash: d8b059769ea0d16e75b87ee331a722cf5fde8648986ca24bcfb81488bb9e8d1f
Instruction Fuzzy Hash: 0322E4B2B1878686FB20DB68F4443DD6761F7817A4F506221EA6D06BEBDFB8C581C301

Function 00000137C15C3AF8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000137C15C3B77
WriteFile.KERNEL32 ref: 00000137C15C3E3F
WriteFile.KERNEL32 ref: 00000137C15C3E85
GetLastError.KERNEL32 ref: 00000137C15C3F3B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: fa227f40509e3349170f30eb00e800148d5492ae5e34f4221cfa920054858855
Instruction ID: 82e1f5d97ece52159f27c432808d0747897057d060e2b5bb90084148742e18d5
Opcode Fuzzy Hash: fa227f40509e3349170f30eb00e800148d5492ae5e34f4221cfa920054858855
Instruction Fuzzy Hash: 7ED1F0B2708A8589E760CF75F4503DC3BB5F348B98F049226DE5A97BDADA38C616C350

Function 00000137C15A81C0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000137C15A81E0
FreeEnvironmentStringsW.KERNEL32 ref: 00000137C15A82DB
RtlInitUnicodeString.NTDLL ref: 00000137C15A834E
RtlInitUnicodeString.NTDLL ref: 00000137C15A835B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: d1cfb9c678f6b3bfd6e15e9b3720f0f3282dc3bc451fd851657b04b91d9ff4b9
Instruction ID: ec630b9b7024b7daa195be28c53e1afadaf0954055752a090acf1d83e64cfa92
Opcode Fuzzy Hash: d1cfb9c678f6b3bfd6e15e9b3720f0f3282dc3bc451fd851657b04b91d9ff4b9
Instruction Fuzzy Hash: 1851B2B2A08B81C2EB218F15F4403AD7370F799B94F54A225EB9903B96DF78D6E1C304

Function 00000137C1564BC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000137C1564BEB
std::_Lockit::_Lockit.LIBCPMT ref: 00000137C1564C10
std::_Facet_Register.LIBCPMT ref: 00000137C1564CBB
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C1564D06

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: d97067b01ae72d56d3a67cf2b4b141078492a953b35c66c447eaf66f69042bf1
Instruction ID: 202144739909c8b8a49bf1cc7e7d998a56a0ff5346cebd210915b5f1da659480
Opcode Fuzzy Hash: d97067b01ae72d56d3a67cf2b4b141078492a953b35c66c447eaf66f69042bf1
Instruction Fuzzy Hash: 48418FB6208B4281FB35DB15F8503EA67A0F788BA4F582535EA4D477EADF38C642C740

Function 00000137C15C0354 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00000137C15C03AB
GetSystemInfo.KERNEL32 ref: 00000137C15C03C4
VirtualAlloc.KERNEL32 ref: 00000137C15C0432
VirtualProtect.KERNEL32 ref: 00000137C15C044D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 8a2bbf003fd111d706c6fd64fcd7f6bc576560aafa18823378a93e99d6bad30c
Instruction ID: 19fd5539eb261f1fb5ac6e0d53d6616b8cca8b452faf3a46f2f7757471a0b9ca
Opcode Fuzzy Hash: 8a2bbf003fd111d706c6fd64fcd7f6bc576560aafa18823378a93e99d6bad30c
Instruction Fuzzy Hash: 1C318C76314A81DEEB20CF32E8947D973A5F748B88F84502AEA4D57B89DF38D645C740

Function 00000137C160B424 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000137C160B46D
GetLastError.KERNEL32 ref: 00000137C160B47B
WideCharToMultiByte.KERNEL32 ref: 00000137C160B4B0
GetLastError.KERNEL32 ref: 00000137C160B4BE

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: ff24e7c81d8dd03fcc82aaf7c0397415c41f33d4ac3d30ba58ee66f2e510de4b
Instruction ID: 2e575cda340baf3b37b2f8ffb65247c5627e40d5b48dce700045b688df7a2acf
Opcode Fuzzy Hash: ff24e7c81d8dd03fcc82aaf7c0397415c41f33d4ac3d30ba58ee66f2e510de4b
Instruction Fuzzy Hash: EA218EB6618B8587E360CF21F44435EB7B4F388F80F645128DB8863B98DF38C6058B04

Function 00000137C15D7058 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000137C15D7084
GetCurrentThreadId.KERNEL32 ref: 00000137C15D7092
GetCurrentProcessId.KERNEL32 ref: 00000137C15D709E
QueryPerformanceCounter.KERNEL32 ref: 00000137C15D70AE

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 066ada9d6ce2bb7bf232f60978bcef186f182671c9b57ade480c1311d2a17256
Instruction ID: fac7105eacd6e8ad0860607f00584b05fe40728287dc6b1e3a5193e0c3d749e2
Opcode Fuzzy Hash: 066ada9d6ce2bb7bf232f60978bcef186f182671c9b57ade480c1311d2a17256
Instruction Fuzzy Hash: B5112A76714F018AEB10CF61F8543E933A4F359B58F442E35EA6D867A4DF78C2A48340

Function 00000137C15AEEE0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15AF0BB
Concurrency::cancel_current_task.LIBCPMT ref: 00000137C15AF2C4

Strings

H, xrefs: 00000137C15AF2D0

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: H
API String ID: 118556049-37590417
Opcode ID: 8d15d4be343cfcc83d1d693c0dcb39653d00ee63b835e551ac0eecf3c45be02d
Instruction ID: 6368333532a847ed740632be621eeab7a521bc562c4f21ecb7833db6454314d1
Opcode Fuzzy Hash: 8d15d4be343cfcc83d1d693c0dcb39653d00ee63b835e551ac0eecf3c45be02d
Instruction Fuzzy Hash: 7AB1D2B2315B8582DA60CB65F8407AE67A4F758BE4F545726EFBD077C6EB38C2908300

Function 00000137C1551330 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 00000137C155146B

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 0064f3b298bbb5b22e3e1219c47950162b9910160a6ee376babcf527f33c7338
Instruction ID: b0dcd27df6248e0d69595d1605943e29794deaa201c702c2463f56d8d71e1e06
Opcode Fuzzy Hash: 0064f3b298bbb5b22e3e1219c47950162b9910160a6ee376babcf527f33c7338
Instruction Fuzzy Hash: 1D7104B2F14B9285F720CB79F4503DD2B61E795B98F146226EE5917BCACB78C2918340

Function 00000137C1597D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000137C1597DCF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000137C1597E17

Strings

bad locale name, xrefs: 00000137C1597EEC

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 3a79e3869d5329002dfa2b05c04b2981efa5ddd06461e8928ffccf14c62afc19
Instruction ID: 02143524430edca83c324204535dd477865bac9ebd2965910c1fac8f4182255c
Opcode Fuzzy Hash: 3a79e3869d5329002dfa2b05c04b2981efa5ddd06461e8928ffccf14c62afc19
Instruction Fuzzy Hash: 40511972305A418DEB24DF71F4913EC23A4EB44748F085435EE5966ADADF34CA268355

Function 00000137C1577440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000137C15774AF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000137C15774F7

Strings

bad locale name, xrefs: 00000137C15775D6

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: ea6d5cef10d377d8c29865afa92fd0f44ff4892c0c6462302a2e263c04c2e362
Instruction ID: 4f0e4bfbad173283d28517d1957d8418b981c209e52b72a80cb27b928847e00d
Opcode Fuzzy Hash: ea6d5cef10d377d8c29865afa92fd0f44ff4892c0c6462302a2e263c04c2e362
Instruction Fuzzy Hash: 7B5129B231AA418EEB20DF70F8913EC33A4EB44748F045539EA4966BDADF34C625D394

Function 00000137C15CA4A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000137C15CF884: _invalid_parameter_noinfo.LIBCMT ref: 00000137C15CF8B7

_get_daylight.LIBCMT ref: 00000137C15CA5BC
_get_daylight.LIBCMT ref: 00000137C15CA5CD

Strings

?, xrefs: 00000137C15CA54D

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: d3b7fbbe46bebe88d9283d06fdf3106ae94709c5750179ab73ce82f8f88f464c
Instruction ID: 71c159f72c741434722d8d918617166e906b0f1e80a7f3cd07297fb6d0bcf29c
Opcode Fuzzy Hash: d3b7fbbe46bebe88d9283d06fdf3106ae94709c5750179ab73ce82f8f88f464c
Instruction Fuzzy Hash: 9B4129B660868246FB349F25F4613EA6BA0E7987E4F14A235EF5507BD7EB38C581C700

Function 00000137C15C4190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000137C15C42A7
GetLastError.KERNEL32 ref: 00000137C15C42C9

Strings

U, xrefs: 00000137C15C4253

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1a35e0ff9681dd9ffee4af38256a35880782598a07eb70b704dcc49749e705a6
Instruction ID: 90b052d8e8c120b7484e94f0d5a1e6150d714e9a8f61cdc1e056093b2c16fd64
Opcode Fuzzy Hash: 1a35e0ff9681dd9ffee4af38256a35880782598a07eb70b704dcc49749e705a6
Instruction Fuzzy Hash: 3A41BFB2318A4182EB209F25F8557EAA7A1F388784F815135EE4E87B99EF3CC641C750

Function 00000137C15D85D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000137C15D8628
RaiseException.KERNEL32 ref: 00000137C15D8669

Strings

csm, xrefs: 00000137C15D8656

Memory Dump Source

Source File: 00000000.00000002.2300877801.00000137C1520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000137C1520000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137c1520000_billys.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: aef85c17f5724204ad0c80a571103dcf5f2f2ffa9173f2d18470242902e0a6db
Instruction ID: 5c82730082df80aaf212fd15a9795e715910f8fa123949450c346fd6c6811105
Opcode Fuzzy Hash: aef85c17f5724204ad0c80a571103dcf5f2f2ffa9173f2d18470242902e0a6db
Instruction Fuzzy Hash: E6116D72219B8182EB618F15F50039977E5F798B94F585224DE8D07799DF3CC661CB00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report billys.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
billys.exe

Function 00000137C15A31C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 227
windowCOMMON

Function 00000137C160B5E0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00000137C155E240 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 00000137C15E3180 Relevance: 19.8, Strings: 15, Instructions: 1071
COMMON

Function 00000137C15996D0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 416
synchronizationCOMMON

Function 00000137C15CA588 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 00000137C15A2890 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 00000137C1612268 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00000137C157D2B0 Relevance: 13.6, APIs: 1, Strings: 6, Instructions: 1378
COMMON

Function 00000137C159C5E0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 00000137C15E83D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre