Edit tour

Windows Analysis Report
N5kEzgUBn6.exe

Overview

General Information

Sample name:	N5kEzgUBn6.exe renamed because original name is a hash value
Original sample name:	b786010ab288fd61617745597967a99d.exe
Analysis ID:	1584331
MD5:	b786010ab288fd61617745597967a99d
SHA1:	0130c977c465931769be8b8e7a0c300fefb3244d
SHA256:	28862d7e7fa8ce768d129d13300e56637a4795ccf6bc100bd5e04d5a682fa1ff
Tags:	exeuser-abuse_ch
Infos:

Detection

CobaltStrike, Metasploit

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

N5kEzgUBn6.exe (PID: 1196 cmdline: "C:\Users\user\Desktop\N5kEzgUBn6.exe" MD5: B786010AB288FD61617745597967A99D)

conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://01.201.227.94:6789/api/v1/worldwide", "User Agent": "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\r\n"}

Threatname: Metasploit

{"Headers": "Accept: */*\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\r\n", "Type": "Metasploit Download", "URL": "http://101.201.227.94/api/v1/worldwide"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x7d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x137:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0xabe1:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0xac4d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2112258203.000001CB512A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x189dd:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19d0e:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Click to see the 7 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T08:33:01.594796+0100	2028765	3	Unknown Traffic	192.168.2.5	49704	101.201.227.94	6789	TCP
2025-01-05T08:33:06.098256+0100	2028765	3	Unknown Traffic	192.168.2.5	49706	101.201.227.94	6789	TCP
2025-01-05T08:33:08.106371+0100	2028765	3	Unknown Traffic	192.168.2.5	49707	101.201.227.94	6789	TCP
2025-01-05T08:33:10.338884+0100	2028765	3	Unknown Traffic	192.168.2.5	49708	101.201.227.94	6789	TCP
2025-01-05T08:33:12.260595+0100	2028765	3	Unknown Traffic	192.168.2.5	49709	101.201.227.94	6789	TCP
2025-01-05T08:33:14.296396+0100	2028765	3	Unknown Traffic	192.168.2.5	49712	101.201.227.94	6789	TCP
2025-01-05T08:33:16.182722+0100	2028765	3	Unknown Traffic	192.168.2.5	49717	101.201.227.94	6789	TCP
2025-01-05T08:33:18.090541+0100	2028765	3	Unknown Traffic	192.168.2.5	49724	101.201.227.94	6789	TCP
2025-01-05T08:33:19.958044+0100	2028765	3	Unknown Traffic	192.168.2.5	49735	101.201.227.94	6789	TCP
2025-01-05T08:33:21.970907+0100	2028765	3	Unknown Traffic	192.168.2.5	49751	101.201.227.94	6789	TCP
2025-01-05T08:33:23.807582+0100	2028765	3	Unknown Traffic	192.168.2.5	49763	101.201.227.94	6789	TCP
2025-01-05T08:33:25.593569+0100	2028765	3	Unknown Traffic	192.168.2.5	49778	101.201.227.94	6789	TCP
2025-01-05T08:33:27.514214+0100	2028765	3	Unknown Traffic	192.168.2.5	49788	101.201.227.94	6789	TCP
2025-01-05T08:33:29.246701+0100	2028765	3	Unknown Traffic	192.168.2.5	49801	101.201.227.94	6789	TCP
2025-01-05T08:33:31.186096+0100	2028765	3	Unknown Traffic	192.168.2.5	49814	101.201.227.94	6789	TCP
2025-01-05T08:33:32.911976+0100	2028765	3	Unknown Traffic	192.168.2.5	49825	101.201.227.94	6789	TCP
2025-01-05T08:33:34.709064+0100	2028765	3	Unknown Traffic	192.168.2.5	49840	101.201.227.94	6789	TCP
2025-01-05T08:33:36.619405+0100	2028765	3	Unknown Traffic	192.168.2.5	49852	101.201.227.94	6789	TCP
2025-01-05T08:33:38.515124+0100	2028765	3	Unknown Traffic	192.168.2.5	49864	101.201.227.94	6789	TCP
2025-01-05T08:33:40.454658+0100	2028765	3	Unknown Traffic	192.168.2.5	49879	101.201.227.94	6789	TCP
2025-01-05T08:33:42.265179+0100	2028765	3	Unknown Traffic	192.168.2.5	49891	101.201.227.94	6789	TCP
2025-01-05T08:33:44.190912+0100	2028765	3	Unknown Traffic	192.168.2.5	49903	101.201.227.94	6789	TCP
2025-01-05T08:33:46.037044+0100	2028765	3	Unknown Traffic	192.168.2.5	49915	101.201.227.94	6789	TCP
2025-01-05T08:33:47.840524+0100	2028765	3	Unknown Traffic	192.168.2.5	49930	101.201.227.94	6789	TCP
2025-01-05T08:33:49.889197+0100	2028765	3	Unknown Traffic	192.168.2.5	49942	101.201.227.94	6789	TCP
2025-01-05T08:33:51.793554+0100	2028765	3	Unknown Traffic	192.168.2.5	49959	101.201.227.94	6789	TCP
2025-01-05T08:33:53.553836+0100	2028765	3	Unknown Traffic	192.168.2.5	49970	101.201.227.94	6789	TCP
2025-01-05T08:33:55.334756+0100	2028765	3	Unknown Traffic	192.168.2.5	49983	101.201.227.94	6789	TCP
2025-01-05T08:33:57.171750+0100	2028765	3	Unknown Traffic	192.168.2.5	49994	101.201.227.94	6789	TCP
2025-01-05T08:34:02.105098+0100	2028765	3	Unknown Traffic	192.168.2.5	50006	101.201.227.94	6789	TCP
2025-01-05T08:34:04.055414+0100	2028765	3	Unknown Traffic	192.168.2.5	50007	101.201.227.94	6789	TCP
2025-01-05T08:34:06.034302+0100	2028765	3	Unknown Traffic	192.168.2.5	50008	101.201.227.94	6789	TCP
2025-01-05T08:34:07.889428+0100	2028765	3	Unknown Traffic	192.168.2.5	50009	101.201.227.94	6789	TCP
2025-01-05T08:34:09.861938+0100	2028765	3	Unknown Traffic	192.168.2.5	50010	101.201.227.94	6789	TCP
2025-01-05T08:34:11.805577+0100	2028765	3	Unknown Traffic	192.168.2.5	50011	101.201.227.94	6789	TCP
2025-01-05T08:34:13.727239+0100	2028765	3	Unknown Traffic	192.168.2.5	50012	101.201.227.94	6789	TCP
2025-01-05T08:34:15.660818+0100	2028765	3	Unknown Traffic	192.168.2.5	50013	101.201.227.94	6789	TCP
2025-01-05T08:34:17.878531+0100	2028765	3	Unknown Traffic	192.168.2.5	50015	101.201.227.94	6789	TCP
2025-01-05T08:34:19.825987+0100	2028765	3	Unknown Traffic	192.168.2.5	50016	101.201.227.94	6789	TCP
2025-01-05T08:34:21.817237+0100	2028765	3	Unknown Traffic	192.168.2.5	50017	101.201.227.94	6789	TCP
2025-01-05T08:34:23.648728+0100	2028765	3	Unknown Traffic	192.168.2.5	50018	101.201.227.94	6789	TCP
2025-01-05T08:34:25.500309+0100	2028765	3	Unknown Traffic	192.168.2.5	50019	101.201.227.94	6789	TCP
2025-01-05T08:34:27.333562+0100	2028765	3	Unknown Traffic	192.168.2.5	50020	101.201.227.94	6789	TCP
2025-01-05T08:34:29.248691+0100	2028765	3	Unknown Traffic	192.168.2.5	50021	101.201.227.94	6789	TCP
2025-01-05T08:34:31.129829+0100	2028765	3	Unknown Traffic	192.168.2.5	50022	101.201.227.94	6789	TCP
2025-01-05T08:34:33.026892+0100	2028765	3	Unknown Traffic	192.168.2.5	50023	101.201.227.94	6789	TCP
2025-01-05T08:34:34.905844+0100	2028765	3	Unknown Traffic	192.168.2.5	50024	101.201.227.94	6789	TCP
2025-01-05T08:34:38.292404+0100	2028765	3	Unknown Traffic	192.168.2.5	50025	101.201.227.94	6789	TCP
2025-01-05T08:34:39.958835+0100	2028765	3	Unknown Traffic	192.168.2.5	50026	101.201.227.94	6789	TCP
2025-01-05T08:34:41.824893+0100	2028765	3	Unknown Traffic	192.168.2.5	50027	101.201.227.94	6789	TCP
2025-01-05T08:34:43.734608+0100	2028765	3	Unknown Traffic	192.168.2.5	50028	101.201.227.94	6789	TCP
2025-01-05T08:34:45.618659+0100	2028765	3	Unknown Traffic	192.168.2.5	50029	101.201.227.94	6789	TCP
2025-01-05T08:34:48.112343+0100	2028765	3	Unknown Traffic	192.168.2.5	50030	101.201.227.94	6789	TCP
2025-01-05T08:34:50.031485+0100	2028765	3	Unknown Traffic	192.168.2.5	50031	101.201.227.94	6789	TCP
2025-01-05T08:34:52.005820+0100	2028765	3	Unknown Traffic	192.168.2.5	50032	101.201.227.94	6789	TCP
2025-01-05T08:34:53.970047+0100	2028765	3	Unknown Traffic	192.168.2.5	50033	101.201.227.94	6789	TCP
2025-01-05T08:34:55.906010+0100	2028765	3	Unknown Traffic	192.168.2.5	50034	101.201.227.94	6789	TCP
2025-01-05T08:34:58.269638+0100	2028765	3	Unknown Traffic	192.168.2.5	50035	101.201.227.94	6789	TCP
2025-01-05T08:35:00.133768+0100	2028765	3	Unknown Traffic	192.168.2.5	50036	101.201.227.94	6789	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://01.201.227.94:6789/api/v1/worldwide", "User Agent": "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\r\n"}
Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: /\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\r\n", "Type": "Metasploit Download", "URL": "http://101.201.227.94/api/v1/worldwide"}

Multi AV Scanner detection for submitted file

Source: N5kEzgUBn6.exe	Virustotal: Detection: 61%			Perma Link
Source: N5kEzgUBn6.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: N5kEzgUBn6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\qqq777\source\repos\QitaZhuru\x64\Release\QitaZhuru.pdb source: N5kEzgUBn6.exe
Source:	Binary string: C:\Users\qqq777\source\repos\QitaZhuru\x64\Release\QitaZhuru.pdb'' source: N5kEzgUBn6.exe

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 7x nop then inc ecx		0_3_000001CB512A000D
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 7x nop then inc ecx		0_3_000001CB512A0000

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://01.201.227.94:6789/api/v1/worldwide
Source: Malware configuration extractor	URLs: http://101.201.227.94/api/v1/worldwide

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 101.201.227.94:6789

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49704 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49709 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49706 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49712 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49707 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49717 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49708 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49735 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49724 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49763 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49801 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49778 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49788 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49852 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49751 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49915 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49864 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49814 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49879 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49825 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49840 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49959 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49903 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49970 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49994 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49983 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50006 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50009 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50007 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50010 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50015 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49930 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50011 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50012 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50018 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49942 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50019 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50024 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50017 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50029 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50032 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50023 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50033 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49891 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50022 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50028 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50031 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50027 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50035 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50030 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50025 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50026 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50020 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50016 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50021 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50008 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50034 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50036 -> 101.201.227.94:6789
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50013 -> 101.201.227.94:6789

Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94
Source: unknown	TCP traffic detected without corresponding DNS query: 101.201.227.94

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Code function: 0_2_000001CB4EDB012B HttpOpenRequestA,VirtualAlloc,InternetReadFile,

0_2_000001CB4EDB012B

Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3EA000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D405000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: N5kEzgUBn6.exe, 00000000.00000003.2090018223.000001CB4EF28000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2090193489.000001CB4EF2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2584ec37094db
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94/
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94/xP
Source: N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EE70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/
Source: N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EE70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/.227.94:6789/api/v1/get
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D405000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2206914235.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2207282103.000001CB4EE71000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2208844737.000001CB4EE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/get
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/get%
Source: N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/get)HY
Source: N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EE70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/get2
Source: N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2207486658.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2206914235.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/getaH
Source: N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2207486658.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2206914235.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/getkH
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/worldwide
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/worldwide.dll:
Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://101.201.227.94:6789/api/v1/worldwideq

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2112258203.000001CB512A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB4EDB010C	0_2_000001CB4EDB010C
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB4F1A0000	0_2_000001CB4F1A0000
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504CF1A8	0_2_000001CB504CF1A8
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504C6B38	0_2_000001CB504C6B38
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504D1528	0_2_000001CB504D1528
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504D0E64	0_2_000001CB504D0E64
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504D1F9C	0_2_000001CB504D1F9C

Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2112258203.000001CB512A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13

Source: classification engine

Classification label: mal88.troj.winEXE@2/3@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03

Source: N5kEzgUBn6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: N5kEzgUBn6.exe	Virustotal: Detection: 61%
Source: N5kEzgUBn6.exe	ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\N5kEzgUBn6.exe "C:\Users\user\Desktop\N5kEzgUBn6.exe"
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: N5kEzgUBn6.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: N5kEzgUBn6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: N5kEzgUBn6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: N5kEzgUBn6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: N5kEzgUBn6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: N5kEzgUBn6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: N5kEzgUBn6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: N5kEzgUBn6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: N5kEzgUBn6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\qqq777\source\repos\QitaZhuru\x64\Release\QitaZhuru.pdb source: N5kEzgUBn6.exe
Source:	Binary string: C:\Users\qqq777\source\repos\QitaZhuru\x64\Release\QitaZhuru.pdb'' source: N5kEzgUBn6.exe

Source: N5kEzgUBn6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: N5kEzgUBn6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: N5kEzgUBn6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: N5kEzgUBn6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: N5kEzgUBn6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Code function: 0_2_00007FF7B2F31130 GetModuleHandleA,GetProcAddress,MessageBoxW,VirtualProtect,MessageBoxW,MessageBoxW,MessageBoxW,VirtualProtect,printf,GetModuleHandleW,LoadLibraryW,GetProcAddress,VirtualAlloc,printf,printf,printf,printf,GetDC,printf,

0_2_00007FF7B2F31130

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A3FD7 push FFFFFFB2h; ret	0_3_000001CB512A3FEF
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A3FD7 push FFFFFFB2h; ret	0_3_000001CB512A402B
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A2026 push ebx; ret	0_3_000001CB512A2033
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A3FF0 push FFFFFFB2h; ret	0_3_000001CB512A402B
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A4058 push FFFFFFB2h; ret	0_3_000001CB512A4067
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A40A8 push FFFFFFB2h; ret	0_3_000001CB512A4067
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A40A8 push ecx; iretd	0_3_000001CB512A40C2
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A392A push ebp; retf	0_3_000001CB512A3946
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_3_000001CB512A38F3 push ebp; retf	0_3_000001CB512A3946
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB4EDB012B push eax; ret	0_2_000001CB4EDB0387
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB4EDB010C push eax; ret	0_2_000001CB4EDB0387
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504DA86F push ebp; iretd	0_2_000001CB504DA870
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504DA898 push ebp; iretd	0_2_000001CB504DA899
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504BF901 push ebx; iretd	0_2_000001CB504BF902
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504BB91C pushad ; retf	0_2_000001CB504BB91D
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504B935D push edi; iretd	0_2_000001CB504B935E
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504BAD58 push ebp; iretd	0_2_000001CB504BAD59
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504B971E push cs; retf	0_2_000001CB504B971F
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_000001CB504DA84F push ebp; iretd	0_2_000001CB504DA850

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3EA000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3AB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Code function: 0_2_00007FF7B2F31CF4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7B2F31CF4

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

0_2_00007FF7B2F31130

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_00007FF7B2F31E98 SetUnhandledExceptionFilter,	0_2_00007FF7B2F31E98
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_00007FF7B2F31CF4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B2F31CF4
Source: C:\Users\user\Desktop\N5kEzgUBn6.exe	Code function: 0_2_00007FF7B2F317DC MessageBoxW,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7B2F317DC

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Code function: 0_2_00007FF7B2F31BD4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7B2F31BD4

Source: C:\Users\user\Desktop\N5kEzgUBn6.exe

Code function: 0_2_000001CB504C4E28 GetUserNameA,strrchr,_snprintf,

0_2_000001CB504C4E28

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match	File source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
N5kEzgUBn6.exe	61%	Virustotal		Browse
N5kEzgUBn6.exe	45%	ReversingLabs	Win64.Backdoor.Cobeacon

Source	Detection	Scanner	Label
https://101.201.227.94:6789/api/v1/getkH	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/worldwideq	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/.227.94:6789/api/v1/get	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/worldwide	0%	Avira URL Cloud	safe
http://01.201.227.94:6789/api/v1/worldwide	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/get%	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/getaH	0%	Avira URL Cloud	safe
https://101.201.227.94/	0%	Avira URL Cloud	safe
http://101.201.227.94/api/v1/worldwide	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/worldwide.dll:	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/get	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/get)HY	0%	Avira URL Cloud	safe
https://101.201.227.94:6789/api/v1/get2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://01.201.227.94:6789/api/v1/worldwide	true	Avira URL Cloud: safe	unknown
http://101.201.227.94/api/v1/worldwide	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://101.201.227.94:6789/.227.94:6789/api/v1/get	N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EE70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/worldwideq	N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/getkH	N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2207486658.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2206914235.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/worldwide	N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D355000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/get%	N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D405000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/getaH	N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2207486658.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2206914235.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94/	N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D3C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/worldwide.dll:	N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D355000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/get	N5kEzgUBn6.exe, 00000000.00000002.3257765917.000001CB4D405000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2206914235.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2207282103.000001CB4EE71000.00000004.00000020.00020000.00000000.sdmp, N5kEzgUBn6.exe, 00000000.00000003.2208844737.000001CB4EE73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/get)HY	N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EEF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/	N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EE70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://101.201.227.94:6789/api/v1/get2	N5kEzgUBn6.exe, 00000000.00000002.3257954168.000001CB4EE70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
101.201.227.94	unknown	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584331
Start date and time:	2025-01-05 08:32:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	N5kEzgUBn6.exe renamed because original name is a hash value
Original Sample Name:	b786010ab288fd61617745597967a99d.exe
Detection:	MAL
Classification:	mal88.troj.winEXE@2/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 13 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 2.22.50.144, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:33:06	API Interceptor	1x Sleep call for process: N5kEzgUBn6.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	setup64v9.3.4.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	199.232.210.172
	c2.hta	Get hash	malicious	Remcos	Browse	199.232.214.172
	phishingtest.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	a36r7SLgH7.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172
	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	199.232.214.172
	2Mi3lKoJfj.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	Reparto Trabajo TP4.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	DcRat, JasonRAT	Browse	199.232.214.172
	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	3.elf	Get hash	malicious	Unknown	Browse	8.189.180.251
	3.elf	Get hash	malicious	Unknown	Browse	8.138.48.163
	armv6l.elf	Get hash	malicious	Unknown	Browse	223.4.27.34
	armv5l.elf	Get hash	malicious	Unknown	Browse	8.130.140.184
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	8.158.86.51
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	8.132.136.89
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	47.114.163.84
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	8.167.229.71
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	47.118.212.14
	armv7l.elf	Get hash	malicious	Mirai	Browse	39.97.241.76

Process:	C:\Users\user\Desktop\N5kEzgUBn6.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\N5kEzgUBn6.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1356875516282012
Encrypted:	false
SSDEEP:	6:kKqVkT9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:QDnLNkPlE99SNxAhUe/3
MD5:	4A09135DBD48250AF811D4B1238580AA
SHA1:	3C51470D8BE156C8E5D01F2A0AC1120271017E55
SHA-256:	21BCA7BE0A9B0514C6DFAB8AAAA4CB6EDF216D1368905F2C59EB99B4F4368639
SHA-512:	2A1D5A5D5B61479D0F8A26945DEDEFCE6C909B1E5DE4B29F104541CA0F66F280BE88F1CFFF94B30308015593C05F9DCE03119F211F62E6D3AA27E01A4684B3C0
Malicious:	false
Reputation:	low
Preview:	p...... ........h.+.D_..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\N5kEzgUBn6.exe
File Type:	ASCII text, with very long lines (31640), with no line terminators
Category:	dropped
Size (bytes):	31640
Entropy (8bit):	2.348214012913038
Encrypted:	false
SSDEEP:	96:WtjUQ7mzvFuQerf6gvIwVVoU/Asns/9wtC:WtjmsQervVVFznslwA
MD5:	ABC950176DB1968172CB6DE873E34FFA
SHA1:	83D58DC06856F4005F9B2434E96C123DBAC64E9E
SHA-256:	202CDBB7B5E5292B8E6A82AA511BD4EBA8A1831A21904EB3712C4EE71C497603
SHA-512:	CBDD81A2941A23A082D17ACEEED41BA4A06EC9C78A026E4517BA633D48305FB79F22D140904ABD8B089BCFDB29E8A7803890E756A9EC8EFAA8F0CEBB6B4CA4C0
Malicious:	false
Reputation:	low
Preview:	1231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231231

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.025958466510093
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	N5kEzgUBn6.exe
File size:	16'384 bytes
MD5:	b786010ab288fd61617745597967a99d
SHA1:	0130c977c465931769be8b8e7a0c300fefb3244d
SHA256:	28862d7e7fa8ce768d129d13300e56637a4795ccf6bc100bd5e04d5a682fa1ff
SHA512:	9c3bf712501828fb47ddb9123ec472fc4beae78be3402fba2bd6c35f97a433cc32dd8bbec46464c45b5b360bba6370ad0c5873bd4428e8887bcb1e79245be174
SSDEEP:	192:ou+0wIIlnoFGyPQPke5k1ExMJunMgve3Q5FCchHGm0qpducRe:ou+9II+GzMok1ExME9W3wmm0dcRe
TLSH:	DE725E8BB3824CEED4264136C877552AD1F1B3191771D69B1790CA2E2F377E0BC26A4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........eH...&...&...&..\|....&.\.'...&.\.#...&.\."...&.\.%...&..\|'...&...'...&.m./...&.m.....&.m.$...&.Rich..&........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400017c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6773E7F3 [Tue Dec 31 12:47:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2e4d0451a0a5618141afbb0028775e18

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7CB8BD9268h
dec eax
add esp, 28h
jmp 00007F7CB8BD8CD7h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00001853h]
dec eax
mov ecx, ebx
call dword ptr [00001842h]
call dword ptr [0000184Ch]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001840h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001834h]
test eax, eax
je 00007F7CB8BD8E69h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00003D2Ah]
call 00007F7CB8BD8F0Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00003E11h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00003DA1h], eax
dec eax
mov eax, dword ptr [00003DFAh]
dec eax
mov dword ptr [00003C6Bh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00003D6Fh], eax
mov dword ptr [00003C45h], C0000409h
mov dword ptr [00003C3Fh], 00000001h
mov dword ptr [00003C49h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e4c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6000	0x204	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0x58	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x35b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3470	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3000	0x208	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14cc	0x1600	ec5d3d6dcce82c7d7614c6d86db811c9	False	0.5871803977272727	data	5.846706926546752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3000	0x1638	0x1800	a5db46c62fb50ab8bbbc31cc4b1c64b4	False	0.3474934895833333	data	3.7937316567644777	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5000	0xad0	0x600	6f1394d82b2cd107e2fb86a7d5f9b057	False	0.7063802083333334	data	6.145879486341178	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6000	0x204	0x400	7ce68a42beaadf6116e3f0cc8964e317	False	0.2880859375	PEX Binary Archive	2.203453160464168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7000	0x1e0	0x200	0b35de07beeb30d1d6013cbca2846303	False	0.525390625	data	4.701503258251789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0x58	0x200	5b0a186b4cf00b7a3df98b4a53f9a8a7	False	0.19921875	data	1.187975255208191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	VirtualProtect, GetModuleHandleA, LoadLibraryW, GetProcAddress, GetModuleHandleW, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, RtlCaptureContext, IsDebuggerPresent, InitializeSListHead
USER32.dll	GetDC, MessageBoxW
VCRUNTIME140.dll	memset, __C_specific_handler, __current_exception, __std_exception_copy, __current_exception_context, __std_exception_destroy, _CxxThrowException, memcpy
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, __acrt_iob_func, __p__commode, _set_fmode
api-ms-win-crt-runtime-l1-1-0.dll	_register_onexit_function, _initialize_onexit_table, _crt_atexit, terminate, _seh_filter_exe, _set_app_type, _cexit, __p___argv, _c_exit, __p___argc, _exit, exit, _initterm_e, _initterm, _get_initial_narrow_environment, _initialize_narrow_environment, _configure_narrow_argv, _register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, malloc, _set_new_mode, free

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T08:33:01.594796+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49704	101.201.227.94	6789	TCP
2025-01-05T08:33:06.098256+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49706	101.201.227.94	6789	TCP
2025-01-05T08:33:08.106371+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49707	101.201.227.94	6789	TCP
2025-01-05T08:33:10.338884+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49708	101.201.227.94	6789	TCP
2025-01-05T08:33:12.260595+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49709	101.201.227.94	6789	TCP
2025-01-05T08:33:14.296396+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49712	101.201.227.94	6789	TCP
2025-01-05T08:33:16.182722+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49717	101.201.227.94	6789	TCP
2025-01-05T08:33:18.090541+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49724	101.201.227.94	6789	TCP
2025-01-05T08:33:19.958044+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49735	101.201.227.94	6789	TCP
2025-01-05T08:33:21.970907+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49751	101.201.227.94	6789	TCP
2025-01-05T08:33:23.807582+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49763	101.201.227.94	6789	TCP
2025-01-05T08:33:25.593569+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49778	101.201.227.94	6789	TCP
2025-01-05T08:33:27.514214+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49788	101.201.227.94	6789	TCP
2025-01-05T08:33:29.246701+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49801	101.201.227.94	6789	TCP
2025-01-05T08:33:31.186096+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49814	101.201.227.94	6789	TCP
2025-01-05T08:33:32.911976+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49825	101.201.227.94	6789	TCP
2025-01-05T08:33:34.709064+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49840	101.201.227.94	6789	TCP
2025-01-05T08:33:36.619405+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49852	101.201.227.94	6789	TCP
2025-01-05T08:33:38.515124+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49864	101.201.227.94	6789	TCP
2025-01-05T08:33:40.454658+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49879	101.201.227.94	6789	TCP
2025-01-05T08:33:42.265179+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49891	101.201.227.94	6789	TCP
2025-01-05T08:33:44.190912+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49903	101.201.227.94	6789	TCP
2025-01-05T08:33:46.037044+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49915	101.201.227.94	6789	TCP
2025-01-05T08:33:47.840524+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49930	101.201.227.94	6789	TCP
2025-01-05T08:33:49.889197+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49942	101.201.227.94	6789	TCP
2025-01-05T08:33:51.793554+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49959	101.201.227.94	6789	TCP
2025-01-05T08:33:53.553836+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49970	101.201.227.94	6789	TCP
2025-01-05T08:33:55.334756+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49983	101.201.227.94	6789	TCP
2025-01-05T08:33:57.171750+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49994	101.201.227.94	6789	TCP
2025-01-05T08:34:02.105098+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50006	101.201.227.94	6789	TCP
2025-01-05T08:34:04.055414+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50007	101.201.227.94	6789	TCP
2025-01-05T08:34:06.034302+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50008	101.201.227.94	6789	TCP
2025-01-05T08:34:07.889428+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50009	101.201.227.94	6789	TCP
2025-01-05T08:34:09.861938+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50010	101.201.227.94	6789	TCP
2025-01-05T08:34:11.805577+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50011	101.201.227.94	6789	TCP
2025-01-05T08:34:13.727239+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50012	101.201.227.94	6789	TCP
2025-01-05T08:34:15.660818+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50013	101.201.227.94	6789	TCP
2025-01-05T08:34:17.878531+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50015	101.201.227.94	6789	TCP
2025-01-05T08:34:19.825987+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50016	101.201.227.94	6789	TCP
2025-01-05T08:34:21.817237+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50017	101.201.227.94	6789	TCP
2025-01-05T08:34:23.648728+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50018	101.201.227.94	6789	TCP
2025-01-05T08:34:25.500309+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50019	101.201.227.94	6789	TCP
2025-01-05T08:34:27.333562+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50020	101.201.227.94	6789	TCP
2025-01-05T08:34:29.248691+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50021	101.201.227.94	6789	TCP
2025-01-05T08:34:31.129829+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50022	101.201.227.94	6789	TCP
2025-01-05T08:34:33.026892+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50023	101.201.227.94	6789	TCP
2025-01-05T08:34:34.905844+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50024	101.201.227.94	6789	TCP
2025-01-05T08:34:38.292404+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50025	101.201.227.94	6789	TCP
2025-01-05T08:34:39.958835+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50026	101.201.227.94	6789	TCP
2025-01-05T08:34:41.824893+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50027	101.201.227.94	6789	TCP
2025-01-05T08:34:43.734608+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50028	101.201.227.94	6789	TCP
2025-01-05T08:34:45.618659+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50029	101.201.227.94	6789	TCP
2025-01-05T08:34:48.112343+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50030	101.201.227.94	6789	TCP
2025-01-05T08:34:50.031485+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50031	101.201.227.94	6789	TCP
2025-01-05T08:34:52.005820+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50032	101.201.227.94	6789	TCP
2025-01-05T08:34:53.970047+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50033	101.201.227.94	6789	TCP
2025-01-05T08:34:55.906010+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50034	101.201.227.94	6789	TCP
2025-01-05T08:34:58.269638+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50035	101.201.227.94	6789	TCP
2025-01-05T08:35:00.133768+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50036	101.201.227.94	6789	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:33:00.643802881 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:00.648716927 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:00.648778915 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:00.678657055 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:00.683480024 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:01.594721079 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:01.594795942 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:01.624299049 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:01.624310970 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:01.624387980 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:01.883915901 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:01.884007931 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:03.015626907 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:03.020435095 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:03.367934942 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:03.367947102 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:03.368041992 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:03.666609049 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:03.666691065 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:03.721340895 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:03.726192951 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.073964119 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074032068 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.074456930 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074506044 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.074508905 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074521065 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074548960 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.074567080 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.074582100 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074594021 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074630022 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.074850082 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.074898005 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.075098991 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.075109005 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.075150967 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.075292110 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.075304031 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.075323105 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.075340033 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.075350046 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.075366974 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.075392008 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.333318949 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333343983 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333355904 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333365917 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333379030 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333389997 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333396912 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.333486080 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.333586931 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333611965 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333653927 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.333903074 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333961010 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.333971977 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.333971977 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334007025 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.334072113 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334083080 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334094048 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334117889 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.334148884 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.334862947 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334875107 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334886074 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.334908009 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.334940910 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.335024118 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335036039 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335047960 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335067034 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.335082054 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.335804939 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335855007 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.335855961 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335866928 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335896015 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.335941076 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335957050 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.335998058 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.578599930 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578624964 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578640938 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578676939 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.578716993 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578727961 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578739882 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.578778982 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.578855991 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578867912 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578880072 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578891039 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.578903913 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.578934908 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579093933 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579138994 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579150915 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579163074 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579186916 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579214096 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579308033 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579327106 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579339027 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579349041 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579369068 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579406023 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579788923 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579830885 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579845905 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579858065 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.579886913 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.579900980 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580010891 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580022097 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580032110 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580044031 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580051899 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580084085 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580157042 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580168009 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580210924 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580815077 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580826998 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580837965 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580862999 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580888987 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580912113 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580924034 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580934048 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580945969 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.580954075 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.580979109 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.581115007 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581127882 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581157923 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.581795931 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581809044 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581823111 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581861973 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.581886053 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.581901073 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581911087 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581922054 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581933022 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.581952095 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.581978083 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.582134008 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582145929 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582174063 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.582185030 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.582793951 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582806110 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582817078 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582835913 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.582865000 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.582906008 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582917929 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.582976103 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838452101 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838475943 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838486910 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838547945 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838594913 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838606119 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838618994 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838629961 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838639975 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838664055 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838682890 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838696003 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838725090 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838792086 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838804007 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838816881 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838829994 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838850975 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838912964 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838953972 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.838960886 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.838972092 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839003086 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839020014 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839034081 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839050055 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839093924 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839217901 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839258909 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839258909 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839272022 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839304924 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839320898 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839342117 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839416981 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839426994 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839440107 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839456081 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839457989 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839485884 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839505911 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839598894 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839610100 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839652061 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839819908 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839864016 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839867115 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839880943 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839903116 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839917898 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.839955091 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839966059 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839977026 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839987040 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.839999914 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840012074 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840034008 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840112925 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840128899 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840146065 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840156078 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840157032 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840168953 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840174913 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840181112 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840194941 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840197086 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840221882 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840246916 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840749979 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840790033 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840801001 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840831041 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840858936 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840884924 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840894938 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840907097 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.840935946 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.840960026 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841124058 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841135025 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841145039 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841156006 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841166973 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841171980 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841178894 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841201067 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841218948 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841310024 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841321945 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841362000 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841748953 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841759920 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841770887 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841795921 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841814041 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841886044 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841897964 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841907978 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841919899 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.841939926 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.841963053 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842036009 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842046976 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842057943 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842068911 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842082977 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842086077 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842093945 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842097998 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842107058 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842125893 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842149973 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842645884 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842660904 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842673063 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842711926 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842724085 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842751980 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842762947 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842773914 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842794895 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842823029 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842910051 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842920065 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842931032 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842941999 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842952013 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842953920 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842962980 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.842978954 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.842993021 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.843158007 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.843168974 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.843199968 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.843548059 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.843588114 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.843590975 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.843602896 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.843636990 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925228119 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925262928 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925272942 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925299883 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925333977 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925414085 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925426006 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925466061 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925503016 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925514936 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925545931 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925663948 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925681114 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925692081 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925704002 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925709963 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925714970 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925745010 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925772905 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:04.925776958 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:04.925817013 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096004963 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096163034 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096174002 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096190929 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096209049 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096218109 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096225023 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096230030 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096287012 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096332073 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096343994 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096355915 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096366882 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096395016 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096414089 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096502066 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096512079 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096558094 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096558094 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096601963 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096616030 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096626997 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096662998 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096821070 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096831083 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096841097 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096857071 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096868038 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096869946 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096899986 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.096918106 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.096925020 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097023010 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097033024 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097043991 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097054958 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097064018 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097065926 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097084045 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097090006 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097119093 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097141027 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097389936 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097400904 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097413063 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097423077 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097433090 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097434998 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097481012 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097616911 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097629070 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097641945 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097652912 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097664118 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097671986 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097716093 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097891092 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097903013 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097913027 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097923994 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097934008 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097934008 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097949028 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097959995 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097970009 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097971916 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.097980976 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097990990 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.097999096 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098002911 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098021030 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098043919 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098368883 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098386049 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098396063 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098438025 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098454952 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098515034 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098531008 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098541021 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098573923 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098637104 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098731995 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098743916 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098753929 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098764896 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098774910 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098777056 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098786116 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.098800898 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098812103 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.098843098 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.099225998 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099237919 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099246979 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099257946 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099267006 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099271059 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.099277973 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099283934 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099289894 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099296093 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099298954 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.099301100 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099308014 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099322081 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099333048 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099339962 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.099345922 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.099375010 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.099399090 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.099761963 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.101296902 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.105504036 CET	49704	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.110310078 CET	6789	49704	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.133300066 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.138139009 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.138217926 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.138443947 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:05.143238068 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:05.143337965 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:06.097913980 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:06.098184109 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:06.098212957 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:06.098256111 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:06.098287106 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:06.359827995 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:06.359894991 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:06.360193014 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:06.361186028 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:06.364939928 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:06.366051912 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.002083063 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.002100945 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.002115011 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.002145052 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:07.002187967 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:07.004933119 CET	49706	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:07.009644985 CET	6789	49706	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.142860889 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:07.148561001 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.148624897 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:07.149033070 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:07.154416084 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:07.154727936 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:08.106281042 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:08.106370926 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:08.106508017 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:08.106527090 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:08.106565952 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:08.106579065 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:08.349615097 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:08.349670887 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:08.350152016 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:08.351169109 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:08.354923964 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:08.355930090 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:09.256779909 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:09.256855011 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:09.256988049 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:09.257101059 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:09.257139921 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:09.259773016 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:09.363274097 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:09.368087053 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:09.368282080 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:09.368477106 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:09.373270035 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:09.373411894 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:10.338809967 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:10.338884115 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:10.339049101 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:10.339061022 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:10.339090109 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:10.339103937 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:10.584929943 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:10.584984064 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:10.585258007 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:10.586307049 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:10.590068102 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:10.591113091 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.242858887 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.242885113 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.242944956 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.242974997 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.242994070 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.243038893 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.243221998 CET	49708	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.247957945 CET	6789	49708	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.285166979 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.290091991 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.290225983 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.290400028 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:11.295167923 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:11.295335054 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:12.260523081 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:12.260595083 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:12.260813951 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:12.260824919 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:12.260864973 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:12.523401976 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:12.523504019 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:12.572433949 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:12.573609114 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:12.577284098 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:12.578362942 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.222424030 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.222439051 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.222487926 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.222528934 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.222628117 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.222673893 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.222966909 CET	49709	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.227801085 CET	6789	49709	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.333611965 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.338397980 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.338469982 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.345324993 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:13.350155115 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:13.350279093 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:14.296097994 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:14.296396017 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:14.296427011 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:14.296437979 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:14.296762943 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:14.542467117 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:14.542578936 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:14.543085098 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:14.548506021 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:14.834444046 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:14.841126919 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.188071012 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.188193083 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.188230991 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.188275099 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.188386917 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.188404083 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.188832998 CET	49712	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.193635941 CET	6789	49712	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.222672939 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.227535009 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.227734089 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.228087902 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:15.232861996 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:15.233031034 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:16.182641029 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:16.182722092 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:16.182948112 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:16.182957888 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:16.183012962 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:16.448678970 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:16.448755980 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:16.449132919 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:16.453963041 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:16.454896927 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:16.459774971 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:17.094521046 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:17.094593048 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:17.094638109 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:17.094702959 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:17.095000029 CET	49717	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:17.101008892 CET	6789	49717	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:17.191378117 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:17.196235895 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:17.196322918 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:17.196615934 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:17.201508999 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:17.201628923 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.090476990 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.090540886 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.090851068 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.090889931 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.090905905 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.090934992 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.307411909 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.307468891 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.307667017 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.308674097 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.312411070 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.313493967 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.900603056 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.900696993 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.900693893 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.900747061 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.900794029 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:18.900845051 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.901086092 CET	49724	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:18.905847073 CET	6789	49724	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.003940105 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:19.008855104 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.008924961 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:19.009304047 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:19.014209986 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.014275074 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.957940102 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.958044052 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:19.958211899 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.958221912 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:19.958273888 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.219223022 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.219281912 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.219902992 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.221044064 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.224734068 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.225898981 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.862732887 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.862890005 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.862977982 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.863873005 CET	49735	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.868633032 CET	6789	49735	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.988261938 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.993057966 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.993331909 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.993333101 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:20.998171091 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:20.998234987 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:21.970849037 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:21.970906973 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:21.971121073 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:21.971141100 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:21.971165895 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:21.971191883 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.221386909 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.221437931 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.223537922 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.224919081 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.228322029 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.229748011 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.880305052 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.880368948 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.880444050 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.880490065 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.909816027 CET	49707	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.910197973 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.914633036 CET	6789	49707	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.914987087 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.915057898 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.915275097 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:22.920066118 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:22.920209885 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:23.807519913 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:23.807581902 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:23.807789087 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:23.807817936 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:23.807843924 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:23.807859898 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.025520086 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.025628090 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.026268959 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.027270079 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.031013966 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.032046080 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.618098974 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.618192911 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.618196964 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.618237019 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.618246078 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.619025946 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.694643021 CET	49751	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.695065975 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.699423075 CET	6789	49751	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.699877024 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.699981928 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.700187922 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:24.704988003 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:24.705132008 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:25.593493938 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:25.593569040 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:25.593753099 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:25.593771935 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:25.593806028 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:25.593831062 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:25.814187050 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:25.814265013 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:25.864967108 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:25.867336988 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:25.869772911 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:25.872174978 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:26.449712992 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:26.449790001 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:26.449944973 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:26.456904888 CET	49778	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:26.461697102 CET	6789	49778	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:26.550827980 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:26.555600882 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:26.557395935 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:26.557707071 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:26.562453985 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:26.562617064 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:27.514092922 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:27.514214039 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:27.514281034 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:27.514307022 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:27.514337063 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:27.514401913 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:27.928018093 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:27.928138971 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:27.928579092 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:27.929882050 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:27.933342934 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:27.934710026 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.276962042 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.277014971 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.277045012 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.277066946 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:28.277131081 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:28.277549028 CET	49788	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:28.282337904 CET	6789	49788	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.347654104 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:28.352498055 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.352574110 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:28.352816105 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:28.357774973 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:28.357784986 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:29.246579885 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:29.246701002 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:29.246970892 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:29.246980906 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:29.247036934 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:29.471446037 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:29.472057104 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:29.472322941 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:29.473591089 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:29.477133036 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:29.478373051 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.063421011 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.063539982 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.063604116 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.063611031 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.063616991 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.063657045 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.063906908 CET	49801	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.068629980 CET	6789	49801	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.097619057 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.102447987 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.102524996 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.102793932 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:30.107592106 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:30.107692957 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.186012983 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.186032057 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.186045885 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.186064959 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.186095953 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.186290979 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.302124023 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.302190065 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.302495003 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.303699970 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.307368040 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.308451891 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.944360018 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.944436073 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.944449902 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.944494963 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.944556952 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:31.944607019 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.956526041 CET	49814	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:31.961345911 CET	6789	49814	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.003936052 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:32.008760929 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.008840084 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:32.009125948 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:32.013897896 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.014041901 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.911834955 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.911976099 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:32.912110090 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.912123919 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:32.912185907 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.154786110 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.157377005 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.157682896 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.158870935 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.162456989 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.163690090 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.732393980 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.732491970 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.732520103 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.732532978 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.732589960 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.732619047 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.732947111 CET	49825	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.737689018 CET	6789	49825	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.753885031 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.758707047 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.758779049 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.758999109 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:33.763766050 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:33.763878107 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:34.708973885 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:34.709064007 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:34.709239960 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:34.709259987 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:34.709289074 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:34.709305048 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:34.967081070 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:34.967245102 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:34.967669010 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:34.968996048 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:34.972495079 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:34.973799944 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:35.616333961 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:35.616391897 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:35.616463900 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:35.616517067 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:35.616736889 CET	49840	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:35.622627020 CET	6789	49840	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:35.660419941 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:35.667778015 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:35.667933941 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:35.668421984 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:35.674976110 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:35.675573111 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:36.619275093 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:36.619405031 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:36.619589090 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:36.619636059 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:36.619654894 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:36.619703054 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:36.874624968 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:36.874715090 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:36.875121117 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:36.876374960 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:36.879899979 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:36.881196022 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.543478012 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.543492079 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.543499947 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.543509007 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.543572903 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:37.543601990 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:37.544035912 CET	49852	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:37.548748970 CET	6789	49852	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.613423109 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:37.618304968 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.618407011 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:37.618612051 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:37.623403072 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:37.623537064 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:38.515053988 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:38.515124083 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:38.515292883 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:38.515304089 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:38.515342951 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:38.741786003 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:38.741899014 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:38.742172956 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:38.743443012 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:38.746964931 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:38.748236895 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.325517893 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.325602055 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.325642109 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.325721025 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:39.325742006 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:39.326092005 CET	49864	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:39.330832005 CET	6789	49864	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.378937006 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:39.383749008 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.385404110 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:39.385626078 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:39.390386105 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:39.390577078 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.454468012 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.454488993 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.454499960 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.454570055 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.454658031 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:40.454658031 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:40.454658031 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:40.592008114 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.592223883 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:40.592556953 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:40.593775034 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:40.597291946 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:40.598527908 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:41.238105059 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:41.238183975 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:41.238251925 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:41.238311052 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:41.243254900 CET	49879	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:41.248018980 CET	6789	49879	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:41.316658020 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:41.321455956 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:41.321523905 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:41.321890116 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:41.326687098 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:41.326847076 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:42.265105963 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:42.265178919 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:42.265398026 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:42.265431881 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:42.265503883 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:42.521836042 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:42.521908998 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:42.522301912 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:42.523909092 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:42.527120113 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:42.528726101 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.163168907 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.163387060 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.163398027 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.163486958 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:43.163830042 CET	49891	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:43.168580055 CET	6789	49891	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.222675085 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:43.227543116 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.227675915 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:43.227966070 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:43.232817888 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:43.232880116 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:44.190649986 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:44.190912008 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:44.191029072 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:44.191046953 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:44.191087961 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:44.191333055 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:44.446804047 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:44.451606989 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:44.451895952 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:44.453149080 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:44.456644058 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:44.457968950 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:45.091135979 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:45.091209888 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:45.091275930 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:45.091582060 CET	49903	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:45.096335888 CET	6789	49903	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:45.144737005 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:45.149588108 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:45.149683952 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:45.149981022 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:45.154776096 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:45.154865026 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.036566019 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.036953926 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.036976099 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.037044048 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.037075996 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.263674974 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.263838053 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.264177084 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.266092062 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.268903971 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.270837069 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.845877886 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.845940113 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.846003056 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.846075058 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.846245050 CET	49915	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.850979090 CET	6789	49915	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.927120924 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.931895018 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.931972027 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.932272911 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:46.937027931 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:46.937149048 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:47.840439081 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:47.840523958 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:47.840744972 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:47.840755939 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:47.840795994 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.057065964 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.057121038 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.057795048 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.059012890 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.062599897 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.063781023 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.646985054 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.647039890 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.647048950 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.647077084 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.647084951 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.647118092 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.647604942 CET	49930	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.652380943 CET	6789	49930	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.675811052 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.680660963 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.683459997 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.683712959 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:48.688569069 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:48.688596010 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:49.889081955 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:49.889197111 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:49.889281988 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:49.889328957 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:49.889375925 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:49.889416933 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.148911953 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.149030924 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.149434090 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.150674105 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.154700994 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.155467033 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.801552057 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.801676035 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.801825047 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.801949978 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.801964045 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.801997900 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.878752947 CET	49763	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.879225016 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.883620024 CET	6789	49763	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.884028912 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.884093046 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.884294033 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:50.889045954 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:50.889209032 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:51.793252945 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:51.793454885 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:51.793467045 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:51.793554068 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:51.793554068 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.026770115 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.027590990 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.027786970 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.028970957 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.032545090 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.033750057 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.609955072 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.609968901 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.609980106 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.610061884 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.610415936 CET	49959	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.616141081 CET	6789	49959	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.661293030 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.666141987 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.666788101 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.667021036 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:52.671804905 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:52.671937943 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:53.553667068 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:53.553836107 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:53.553906918 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:53.553917885 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:53.553956032 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:53.782613039 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:53.782773972 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:53.797554970 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:53.802362919 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:53.873711109 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:53.878531933 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.376256943 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.376333952 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.376352072 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.376382113 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.376414061 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.376432896 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.376827955 CET	49970	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.381623030 CET	6789	49970	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.425847054 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.430617094 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.430687904 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.430970907 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:54.435723066 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:54.435894966 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:55.334680080 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:55.334706068 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:55.334755898 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:55.334785938 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:55.555736065 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:55.555816889 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:55.556140900 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:55.557307005 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:55.560882092 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:55.562146902 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.147871971 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.147937059 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.147977114 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.148029089 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.148106098 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.148195982 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.148380995 CET	49983	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.153079033 CET	6789	49983	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.207103014 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.211961985 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.212068081 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.212388039 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:56.217219114 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:56.217264891 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:57.171679020 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:57.171750069 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:57.171972990 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:57.171984911 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:57.172023058 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:57.434026957 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:57.435869932 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:57.438270092 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:57.443018913 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:57.443950891 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:57.448779106 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.074901104 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.074934006 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.075031996 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:58.075059891 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.075162888 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:58.075656891 CET	49994	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:58.080465078 CET	6789	49994	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.128990889 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:58.133822918 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.133905888 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:58.134179115 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:33:58.138947010 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:33:58.139128923 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:02.104984045 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:02.105098009 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:02.105190039 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:02.105201960 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:02.105276108 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:02.351521969 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:02.351597071 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:02.352013111 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:02.353234053 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:02.356785059 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:02.358057022 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.005733967 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.005805969 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:03.006130934 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.006143093 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.006196022 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:03.006536961 CET	50006	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:03.011352062 CET	6789	50006	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.100245953 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:03.105192900 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.105312109 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:03.105807066 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:03.110563040 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:03.110842943 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.055329084 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.055413961 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.055511951 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.055522919 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.055563927 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.317418098 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.317687988 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.318028927 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.319166899 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.325392962 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.326541901 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.960432053 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.960448027 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.960529089 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.960856915 CET	50007	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:04.965620041 CET	6789	50007	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:04.988321066 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:05.130645990 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:05.130739927 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:05.135353088 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:05.140166044 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:05.140265942 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.034112930 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.034301996 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.034306049 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.034317017 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.034379005 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.034415960 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.250587940 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.250785112 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.251107931 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.252368927 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.255917072 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.257190943 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.832690954 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.832808971 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.832813978 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.832890987 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.833147049 CET	50008	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.837922096 CET	6789	50008	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.925942898 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.930948019 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.931031942 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.931453943 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:06.936275005 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:06.936621904 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:07.889270067 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:07.889375925 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:07.889390945 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:07.889427900 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:07.889456987 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.154078960 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.154259920 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.154566050 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.156052113 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.159343958 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.160856009 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.801410913 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.801449060 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.801532030 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.801554918 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.801862955 CET	50009	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.806699991 CET	6789	50009	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.879024982 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.883930922 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.884032011 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.884330034 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:08.889087915 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:08.889255047 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:09.861869097 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:09.861938000 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:09.862108946 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:09.862122059 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:09.862174988 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:09.862174988 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.107232094 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.107321978 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.107752085 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.109070063 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.112440109 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.113848925 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.751374006 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.751457930 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.751460075 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.751471996 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.751528025 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.751944065 CET	50010	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.756695986 CET	6789	50010	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.832314014 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.837131977 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.837234974 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.837766886 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:10.842550993 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:10.842607975 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:11.805486917 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:11.805577040 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:11.805988073 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:11.806015015 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:11.806052923 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:11.806068897 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.066534042 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.066621065 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.067070961 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.068350077 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.071862936 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.073184967 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.710978031 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.711009979 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.711190939 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.711190939 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.718765974 CET	50011	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.723555088 CET	6789	50011	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.770006895 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.774843931 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.774919033 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.775352955 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:12.780208111 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:12.780219078 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:13.727133036 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:13.727238894 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:13.727391005 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:13.727425098 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:13.727447033 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:13.727463961 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:13.976291895 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:13.976465940 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:13.976864100 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:13.978018045 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:13.981612921 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:13.982836008 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.619287968 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.619371891 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.619395971 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.619437933 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.619442940 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.619482040 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.619822025 CET	50012	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.624526978 CET	6789	50012	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.707123995 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.711975098 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.712057114 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.712379932 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:14.717252016 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:14.717288971 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:15.660731077 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:15.660818100 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:15.661020994 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:15.661051035 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:15.661066055 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:15.661094904 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:15.917624950 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:15.917723894 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:15.918201923 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:15.923008919 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:15.923697948 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:15.928422928 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:16.833877087 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:16.833939075 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:16.833965063 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:16.834009886 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:16.834430933 CET	50013	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:16.839157104 CET	6789	50013	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:16.910432100 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:16.916239023 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:16.916347027 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:16.916737080 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:16.922353029 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:16.922911882 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:17.878410101 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:17.878530979 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:17.878601074 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:17.878612041 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:17.878660917 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.137207031 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.137316942 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.137736082 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.139069080 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.142494917 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.143913984 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.782459021 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.782557011 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.782663107 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.782990932 CET	50015	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.787792921 CET	6789	50015	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.847722054 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.852525949 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.852600098 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.852870941 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:18.857665062 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:18.857786894 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:19.825892925 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:19.825937986 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:19.825948000 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:19.825987101 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:19.826024055 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.075145006 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.075248003 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.075640917 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.076865911 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.080354929 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.081643105 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.715992928 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.716085911 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.716125011 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.716176033 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.716204882 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.716257095 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.716590881 CET	50016	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.721426010 CET	6789	50016	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.738336086 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.743155956 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.743242025 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.743573904 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:20.748330116 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:20.748420954 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.817027092 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.817044973 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.817055941 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.817066908 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.817236900 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:21.817236900 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:21.959184885 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.959374905 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:21.959604025 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:21.960921049 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:21.964355946 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:21.965662956 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:22.613249063 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:22.613336086 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:22.613434076 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:22.613482952 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:22.687553883 CET	49942	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:22.688112020 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:22.692518950 CET	6789	49942	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:22.692922115 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:22.692991018 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:22.693265915 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:22.698076010 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:22.698137999 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:23.648655891 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:23.648727894 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:23.648964882 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:23.648977041 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:23.649014950 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:23.902848005 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:23.902965069 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:23.903423071 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:23.906620979 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:23.908220053 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:23.911474943 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.547168970 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.547216892 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.547374964 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.547434092 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:24.547473907 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:24.547754049 CET	50018	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:24.552505016 CET	6789	50018	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.597707987 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:24.602510929 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.602586985 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:24.602839947 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:24.607610941 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:24.607702971 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:25.500231981 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:25.500308990 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:25.500370026 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:25.500416040 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:25.500431061 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:25.500472069 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:25.728528023 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:25.728605986 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:25.729053974 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:25.730628967 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:25.733825922 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:25.735428095 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:26.308996916 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:26.309037924 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:26.309257030 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:26.309257030 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:26.321609974 CET	50019	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:26.326868057 CET	6789	50019	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:26.364876032 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:26.370100021 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:26.370213985 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:26.370564938 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:26.375725031 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:26.375735998 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:27.333497047 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:27.333561897 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:27.333795071 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:27.333806038 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:27.333846092 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:27.578564882 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:27.578835011 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:27.579510927 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:27.583209991 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:27.584445953 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:27.590148926 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.220709085 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.220788002 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.220846891 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.220890999 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.221004963 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.221004963 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.221148968 CET	50020	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.225893021 CET	6789	50020	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.301007032 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.305840969 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.305921078 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.306237936 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:28.311029911 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:28.311157942 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:29.248486996 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:29.248691082 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:29.249151945 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:29.249162912 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:29.249216080 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:29.509212017 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:29.509432077 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:29.509712934 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:29.510962963 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:29.514487982 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:29.515794039 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:30.134617090 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:30.134644985 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:30.134741068 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:30.135123014 CET	50021	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:30.140584946 CET	6789	50021	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:30.208111048 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:30.212980986 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:30.213088989 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:30.213574886 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:30.218455076 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:30.218473911 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.129518032 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.129697084 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.129708052 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.129828930 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.358210087 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.361603975 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.378165007 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.379604101 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.382910013 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.384345055 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.968246937 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.968329906 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.968396902 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.968451023 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.968462944 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:31.968524933 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.968767881 CET	50022	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:31.973526955 CET	6789	50022	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:32.054384947 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:32.059365034 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:32.059452057 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:32.059974909 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:32.064738989 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:32.064897060 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.026777983 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.026885033 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.026891947 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.026913881 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.026938915 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.026962042 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.273359060 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.273469925 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.273968935 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.275214911 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.278692961 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.280011892 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.923876047 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.923892975 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.923904896 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:33.923988104 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.924606085 CET	50023	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:33.929341078 CET	6789	50023	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.015412092 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:34.020406008 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.020517111 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:34.020896912 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:34.025667906 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.025805950 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.905765057 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.905843973 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:34.906002998 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.906013966 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:34.906049013 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:34.906063080 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.145240068 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.145329952 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.149442911 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.150669098 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.154253006 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.156223059 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.726767063 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.726857901 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.726941109 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.727304935 CET	50024	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.732049942 CET	6789	50024	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.769716978 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.774570942 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.774674892 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.774977922 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:35.779829979 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:35.779871941 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.292272091 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.292290926 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.292301893 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.292326927 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.292337894 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.292403936 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.292459011 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.292465925 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.297271013 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.297327042 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.297522068 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.298762083 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.302334070 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.303558111 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.946480036 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.946507931 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:38.946579933 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.946604013 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.946945906 CET	50025	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:38.951663017 CET	6789	50025	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.051001072 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:39.055958986 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.056052923 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:39.056400061 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:39.061208963 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.061275005 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.958770037 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.958834887 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:39.958945990 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.958957911 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:39.958998919 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.181591988 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.181699038 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.182085037 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.183213949 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.186856985 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.187952042 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.774131060 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.774231911 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.774312973 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.774365902 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.774557114 CET	50026	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.779326916 CET	6789	50026	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.863471031 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.868371010 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.868455887 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.868725061 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:40.874208927 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:40.874315023 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:41.824805975 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:41.824831963 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:41.824845076 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:41.824892998 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:41.824923038 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.084547997 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.085539103 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.089982033 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.091206074 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.094809055 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.096024036 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.729880095 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.729937077 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.729950905 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.729973078 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.729975939 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.730025053 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.730417967 CET	50027	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.735224962 CET	6789	50027	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.769973040 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.774988890 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.775094986 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.780275106 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:42.785120010 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:42.785181999 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:43.734487057 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:43.734607935 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:43.734631062 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:43.734642029 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:43.734682083 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:43.734695911 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:43.979762077 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:43.979860067 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:43.980370998 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:43.981681108 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:43.985169888 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:43.986450911 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:44.620732069 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:44.620800018 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:44.621208906 CET	6789	50028	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:44.621256113 CET	50028	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:44.659989119 CET	50017	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:44.660520077 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:44.664797068 CET	6789	50017	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:44.665344000 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:44.665410995 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:44.665703058 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:44.670512915 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:44.670614004 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:45.618560076 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:45.618659019 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:45.618829012 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:45.618845940 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:45.618884087 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:45.618901968 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:45.881052971 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:45.881124973 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:45.881838083 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:45.884327888 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:45.886600971 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:45.889086962 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:47.123451948 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:47.123554945 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:47.123634100 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:47.123676062 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:47.123907089 CET	50029	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:47.128684044 CET	6789	50029	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:47.160257101 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:47.165087938 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:47.165173054 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:47.165446997 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:47.170193911 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:47.170360088 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:48.112145901 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:48.112294912 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:48.112306118 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:48.112343073 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:48.112374067 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:48.357429981 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:48.357533932 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:48.357918024 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:48.359164953 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:48.362711906 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:48.363925934 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.004050016 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.004067898 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.004076958 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.004199982 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:49.004553080 CET	50030	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:49.009900093 CET	6789	50030	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.066565037 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:49.071469069 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.071546078 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:49.071819067 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:49.076638937 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:49.076775074 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.031348944 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.031388998 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.031399012 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.031485081 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.031519890 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.290209055 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.290339947 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.290761948 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.292063951 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.295643091 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.296878099 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.933419943 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.933511972 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:50.933518887 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.933585882 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.933974981 CET	50031	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:50.939508915 CET	6789	50031	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:51.035593987 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:51.041145086 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:51.041218996 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:51.041676044 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:51.047137022 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:51.047147989 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.005739927 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.005820036 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.006310940 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.006323099 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.006371975 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.256901026 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.256980896 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.257370949 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.258498907 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.262159109 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.263360977 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.898009062 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.898072004 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.898081064 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:52.898129940 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.898623943 CET	50032	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:52.903371096 CET	6789	50032	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.023144960 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:53.028069019 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.028213978 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:53.032258987 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:53.037045002 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.037185907 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.969866991 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.970046997 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:53.970087051 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.970103025 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:53.970144987 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:53.970169067 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.227405071 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.227464914 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.228070021 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.229597092 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.232783079 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.234375954 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.866873026 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.866908073 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.866936922 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.866972923 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.867317915 CET	50033	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.872051954 CET	6789	50033	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.941565990 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.946450949 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.948040009 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.948328972 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:54.953074932 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:54.953203917 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:55.905915022 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:55.905934095 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:55.905989885 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:55.906009912 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:55.906168938 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:56.186495066 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:56.186630964 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:56.198884010 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:56.199984074 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:56.204119921 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:56.205267906 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:56.843828917 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:56.843947887 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:56.843976021 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:56.844022036 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:57.245805025 CET	50034	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:57.251693964 CET	6789	50034	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:57.348504066 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:57.353969097 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:57.354037046 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:57.354536057 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:57.359675884 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:57.359954119 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:58.269450903 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:58.269633055 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:58.269638062 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:58.269644022 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:58.269768953 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:58.502042055 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:58.502218962 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:58.502659082 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:58.504080057 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:58.507463932 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:58.508822918 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.080884933 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.080945969 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.081007957 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.081058025 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:59.081154108 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:59.081552029 CET	50035	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:59.086270094 CET	6789	50035	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.160502911 CET	50036	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:59.165469885 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.165534019 CET	50036	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:59.165824890 CET	50036	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:34:59.170567989 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:34:59.170799971 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:35:00.133606911 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:35:00.133702040 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:35:00.133712053 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:35:00.133768082 CET	50036	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:35:00.133845091 CET	50036	6789	192.168.2.5	101.201.227.94
Jan 5, 2025 08:35:00.381572962 CET	6789	50036	101.201.227.94	192.168.2.5
Jan 5, 2025 08:35:00.381635904 CET	50036	6789	192.168.2.5	101.201.227.94

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 08:33:12.905105114 CET	1.1.1.1	192.168.2.5	0x4456	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 08:33:12.905105114 CET	1.1.1.1	192.168.2.5	0x4456	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 08:34:15.178832054 CET	1.1.1.1	192.168.2.5	0x31c1	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 08:34:15.178832054 CET	1.1.1.1	192.168.2.5	0x31c1	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:32:53
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\N5kEzgUBn6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\N5kEzgUBn6.exe"
Imagebase:	0x7ff7b2f30000
File size:	16'384 bytes
MD5 hash:	B786010AB288FD61617745597967A99D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3257765917.000001CB4D33C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2112258203.000001CB512A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	02:32:53
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	67.2%
Signature Coverage:	14.7%
Total number of Nodes:	387
Total number of Limit Nodes:	24

Executed Functions

Function 00007FF7B2F31130 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 161
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B2F31560: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7B2F31161), ref: 00007FF7B2F31972

GetModuleHandleA.KERNEL32 ref: 00007FF7B2F3116B
GetProcAddress.KERNEL32 ref: 00007FF7B2F3117B
VirtualProtect.KERNEL32 ref: 00007FF7B2F31199
MessageBoxW.USER32 ref: 00007FF7B2F311CD

Part of subcall function 00007FF7B2F31070: VirtualProtect.KERNEL32 ref: 00007FF7B2F3109D
Part of subcall function 00007FF7B2F31070: VirtualProtect.KERNEL32 ref: 00007FF7B2F3110F

VirtualProtect.KERNEL32 ref: 00007FF7B2F311EE
printf.MSPDB140-MSVCRT ref: 00007FF7B2F31237

Part of subcall function 00007FF7B2F31010: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7B2F31038
Part of subcall function 00007FF7B2F31010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7B2F31057

GetModuleHandleW.KERNEL32 ref: 00007FF7B2F31251
LoadLibraryW.KERNEL32 ref: 00007FF7B2F31263
GetProcAddress.KERNEL32 ref: 00007FF7B2F31273
VirtualAlloc.KERNEL32 ref: 00007FF7B2F31293
printf.MSPDB140-MSVCRT ref: 00007FF7B2F312B7
printf.MSPDB140-MSVCRT ref: 00007FF7B2F312D7
printf.MSPDB140-MSVCRT ref: 00007FF7B2F31367
printf.MSPDB140-MSVCRT ref: 00007FF7B2F31379
GetDC.USER32 ref: 00007FF7B2F31386
printf.MSPDB140-MSVCRT ref: 00007FF7B2F313A6

Strings

VirtualAlloc, xrefs: 00007FF7B2F31269
GDI32.dll, xrefs: 00007FF7B2F31161
success!, xrefs: 00007FF7B2F311C6
EnumFontsW, xrefs: 00007FF7B2F31174
KERNEL32.dll, xrefs: 00007FF7B2F3124A, 00007FF7B2F3125C
0x%02x , xrefs: 00007FF7B2F31223
123, xrefs: 00007FF7B2F312B0, 00007FF7B2F312D0, 00007FF7B2F31360, 00007FF7B2F31372
Memory allocation failed., xrefs: 00007FF7B2F3139F

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID: printf$Virtual$Protect$AddressHandleModuleProc$AllocLibraryLoadMessage__acrt_iob_func__stdio_common_vfprintfmalloc
String ID: 0x%02x $123$EnumFontsW$GDI32.dll$KERNEL32.dll$Memory allocation failed.$VirtualAlloc$success!
API String ID: 2157727273-4213451396
Opcode ID: 2d7b9f36c703e26bc2a17c15817f25bece1dcc53cbba8c08a8a3c25c199c4725
Instruction ID: 804fa856784a3c4beea25a74bc5af7dc25b39b30798c3f7cb42691845de7a473
Opcode Fuzzy Hash: 2d7b9f36c703e26bc2a17c15817f25bece1dcc53cbba8c08a8a3c25c199c4725
Instruction Fuzzy Hash: 8471C912F1E68289F702EB29D9002F9A720FBAAB85F849131DF4D43659DF7CE585C350

Function 000001CB4EDB010C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 203
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000003,00000003,00000002,00000001), ref: 000001CB4EDB0127

Part of subcall function 000001CB4EDB012B: HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 000001CB4EDB0146

Strings

0.9,, xrefs: 000001CB4EDB0221

Memory Dump Source

Source File: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CB4EDB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb4edb0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequest
String ID: 0.9,
API String ID: 1341064763-3756043534
Opcode ID: 4d03da431280f1b9088e9bd0ef49b404d73f94cee98171a195dce8ef4c8b781e
Instruction ID: b2f836c2088342f8a8a5ec2dce021cd946a48dc87b4c787db3e2f11e973ac550
Opcode Fuzzy Hash: 4d03da431280f1b9088e9bd0ef49b404d73f94cee98171a195dce8ef4c8b781e
Instruction Fuzzy Hash: 8F51B83259D2E5CEF76DCB6496CBBA6BB90EB06310F24149ED883C7093E6A0CC42C345

Function 000001CB4EDB012B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 000001CB4EDB0146
VirtualAlloc.KERNEL32(?,656D6F72,303D713B), ref: 000001CB4EDB034B
InternetReadFile.WININET(000001CB4EDB0159,000001CB4EDB0159), ref: 000001CB4EDB0369

Strings

U.;, xrefs: 000001CB4EDB0141

Memory Dump Source

Source File: 00000000.00000002.3257941667.000001CB4EDB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CB4EDB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb4edb0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: AllocFileHttpInternetOpenReadRequestVirtual
String ID: U.;
API String ID: 1187293180-4213443877
Opcode ID: adec595657f368ce4ef907db946545fd41c076732220fa221c3da79f5f998a0b
Instruction ID: a219b6b14f76e1642e77d51bfa02fec9a7ee19c07b703db988ba2507e384addd
Opcode Fuzzy Hash: adec595657f368ce4ef907db946545fd41c076732220fa221c3da79f5f998a0b
Instruction Fuzzy Hash: E5118E6038C94D1BF62C819D7CAAB7651CAD3C8755F24812FB50FC33D6ED54CC828019

Function 000001CB504C4E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CB504C4FEC: malloc.LIBCMT ref: 000001CB504C5008

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,?,-00000001,?,00000002,000001CB504BBC89), ref: 000001CB504C4EAF
strrchr.LIBCMT ref: 000001CB504C4EED
_snprintf.LIBCMT ref: 000001CB504C4F9B

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: NameUser_snprintfmallocstrrchr
String ID:
API String ID: 1238167203-0
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 2c87ace4ed81f3a372994af1cdc27cf29162162793359f53b412e4b69a5168f5
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 7751603075CA480FFB58AB6CA496BA972E2FBC8310F14456DE58FC3293DE38D8428745

Function 000001CB4F1A0000 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 000001CB4F1A00D0

Memory Dump Source

Source File: 00000000.00000002.3258334550.000001CB4F1A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB4F1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb4f1a0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction ID: dffaf1ae61449337c6512d31af13d77749c286a7987b5cc57536dc92a1dbfda8
Opcode Fuzzy Hash: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction Fuzzy Hash: E951553068CA458FE71DCE1C85CAE3A77D1EB95305F15926CD59BCB26BCA30DC52C680

Function 00007FF7B2F313D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 73
libraryloaderwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B2F313E6
printf.MSPDB140-MSVCRT ref: 00007FF7B2F31407

Part of subcall function 00007FF7B2F31010: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7B2F31038
Part of subcall function 00007FF7B2F31010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7B2F31057

printf.MSPDB140-MSVCRT ref: 00007FF7B2F3141B
GetProcAddress.KERNEL32 ref: 00007FF7B2F31430
printf.MSPDB140-MSVCRT ref: 00007FF7B2F31449
printf.MSPDB140-MSVCRT ref: 00007FF7B2F314B7
printf.MSPDB140-MSVCRT ref: 00007FF7B2F314D7
MessageBoxW.USER32 ref: 00007FF7B2F314F5
printf.MSPDB140-MSVCRT ref: 00007FF7B2F31507

Strings

Failed to get function address., xrefs: 00007FF7B2F313F9, 00007FF7B2F31442
user32.dll, xrefs: 00007FF7B2F313DF
MessageBoxW, xrefs: 00007FF7B2F31426
relaysec, xrefs: 00007FF7B2F314E5, 00007FF7B2F314EC
123, xrefs: 00007FF7B2F31414, 00007FF7B2F31470, 00007FF7B2F31490, 00007FF7B2F314B0, 00007FF7B2F314D0, 00007FF7B2F31500

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID: printf$AddressHandleMessageModuleProc__acrt_iob_func__stdio_common_vfprintf
String ID: 123$Failed to get function address.$MessageBoxW$relaysec$user32.dll
API String ID: 608621153-2114858615
Opcode ID: 74bb73f61501d130d57f59b4a0508dd7efc8ac99fada5843b22abce5ffedee7d
Instruction ID: 189b5c78438b587941363455584633a192f8ad25b351ba9399d6f3a5e57b7ff6
Opcode Fuzzy Hash: 74bb73f61501d130d57f59b4a0508dd7efc8ac99fada5843b22abce5ffedee7d
Instruction Fuzzy Hash: 10317061E1E58388FA02FB19EA442B5E254BFB7B96FC44031DA0D4365DDEBCE504C360

Function 00007FF7B2F3164C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B2F31675
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B2F316E3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B2F31731
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B2F31736
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B2F3173E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B2F31746
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B2F31768
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B2F317C2

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: ef8af790725af1cd56919066dc104625b72fed23ec5458473e64ed65ca9d9ef1
Instruction ID: 86138cab7ae967981d5bebecb3535167dabd9184fcf3b1692eee552681e14a8d
Opcode Fuzzy Hash: ef8af790725af1cd56919066dc104625b72fed23ec5458473e64ed65ca9d9ef1
Instruction Fuzzy Hash: 81311D11A0E14789FA12BB6D94512FA9291AF67786FC84034DB4E472DBDEACE805C271

Function 000001CB504BD68C Relevance: 7.8, APIs: 5, Instructions: 260
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001CB504BD725

Part of subcall function 000001CB504CE63C: _errno.LIBCMT ref: 000001CB504CE673
Part of subcall function 000001CB504CE63C: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CE67E

_snprintf.LIBCMT ref: 000001CB504BD7BD
InternetQueryDataAvailable.WININET ref: 000001CB504BD87A

Part of subcall function 000001CB504C1D70: strchr.LIBCMT ref: 000001CB504C1DD6
Part of subcall function 000001CB504C1D70: _snprintf.LIBCMT ref: 000001CB504C1E0C

Part of subcall function 000001CB504C1C0C: strchr.LIBCMT ref: 000001CB504C1C69
Part of subcall function 000001CB504C1C0C: _snprintf.LIBCMT ref: 000001CB504C1CB3

_snprintf.LIBCMT ref: 000001CB504BD7D4

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$AvailableDataInternetQuery_errno_invalid_parameter_noinfo
String ID:
API String ID: 2459009813-0
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: ad5fb06e831ce89f990c6d47d9906aecfdb7b015a2e936619223d9443cbb5e61
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: 1B81B53165CA488FEB59EB14E8C6BEAB3F5FB94311F10456EE48AC3191EF78D9018781

Function 000001CB504BE014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001CB504BE042
WSAIoctl.WS2_32 ref: 000001CB504BE08F

Strings

_Cy, xrefs: 000001CB504BE0A1

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: IoctlSocket
String ID: _Cy
API String ID: 1409745359-1085951347
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 89b9c04b755c6f26979a23561de01739e7208000f1fad5ef154a638eaf4d69bc
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: A631D93060CA584FEB64EF29A4C5BA6B7E1FBE8315F114A3EE54EC3291DB74C5418741

Function 00007FF7B2F31070 Relevance: 3.0, APIs: 2, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FF7B2F3109D
VirtualProtect.KERNEL32 ref: 00007FF7B2F3110F

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0d252d6bf26d72b5eca4e16ffdbf3449286fa4745bd3b762a0840a18dcd28e9b
Instruction ID: 9525cd23282550da26050668a110ddf1bbd064aab55d26c2a48e093afee2a17a
Opcode Fuzzy Hash: 0d252d6bf26d72b5eca4e16ffdbf3449286fa4745bd3b762a0840a18dcd28e9b
Instruction Fuzzy Hash: 1511731372A7C88AEB119F79A400199BF60E76AF48B889025CB8C0B71ACA3CD115C721

Function 000001CB504CC3B8 Relevance: 1.6, APIs: 1, Instructions: 122
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 000001CB504CC49E

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aac624e9975941b750356ceb78cd3aa232c6bd2fb96b7d29432793f1a6c54ced
Instruction ID: a4c812d174f21004849660a4db33932ab82fb515d303c2c47544bee5593cfe07
Opcode Fuzzy Hash: aac624e9975941b750356ceb78cd3aa232c6bd2fb96b7d29432793f1a6c54ced
Instruction Fuzzy Hash: D7314F3065CB098FFB98DF5CB8A6A6537E5FB98310F10416EE44AC3265DB74DC418786

Function 000001CB504CC1C8 Relevance: 1.4, APIs: 1, Instructions: 121
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 000001CB504CC2B0

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aae31d7e320f49b2b7b8d2523f04f5552282cf255c9fc24f679e558ee007d563
Instruction ID: d407570d0bef4acb215e7c497485fda58881b5d9ff9f950693a74ecd1eec25dc
Opcode Fuzzy Hash: aae31d7e320f49b2b7b8d2523f04f5552282cf255c9fc24f679e558ee007d563
Instruction Fuzzy Hash: B3316330A5CB548FFB95DF9CB892A6A77E1FB98300F10056EE449C3251DB34EC418B82

Function 000001CB504CC2EC Relevance: 1.3, APIs: 1, Instructions: 75
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 000001CB504CC3A2

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 33013136f0bb95f1eb9f3645b418df4a5ff2efb559231014e174e8ee2656166c
Instruction ID: 1a88ccec802dbaf9979408d0b1fe5dee9b0aca16fa84cec32815b9c7816ba253
Opcode Fuzzy Hash: 33013136f0bb95f1eb9f3645b418df4a5ff2efb559231014e174e8ee2656166c
Instruction Fuzzy Hash: FF213B70649A888FFB95DB58B489B6937F5FB98311F10492AD849C32B0CB78D980CB81

Non-executed Functions

Function 000001CB504D1F9C Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 000001CB504D0600: _getptd.LIBCMT ref: 000001CB504D0616
Part of subcall function 000001CB504D0600: __updatetlocinfo.LIBCMT ref: 000001CB504D064B
Part of subcall function 000001CB504D0600: __updatetmbcinfo.LIBCMT ref: 000001CB504D0672

_errno.LIBCMT ref: 000001CB504D2002

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_fileno.LIBCMT ref: 000001CB504D202F

Part of subcall function 000001CB504D4A54: _errno.LIBCMT ref: 000001CB504D4A5D
Part of subcall function 000001CB504D4A54: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504D4A68

write_multi_char.LIBCMT ref: 000001CB504D266B
write_string.LIBCMT ref: 000001CB504D2688
write_multi_char.LIBCMT ref: 000001CB504D26A5
write_string.LIBCMT ref: 000001CB504D2704
write_multi_char.LIBCMT ref: 000001CB504D275D
free.LIBCMT ref: 000001CB504D2771
_isleadbyte_l.LIBCMT ref: 000001CB504D2842
write_char.LIBCMT ref: 000001CB504D2858
write_char.LIBCMT ref: 000001CB504D2879
_errno.LIBCMT ref: 000001CB504D297C
_invalid_parameter_noinfo.LIBCMT ref: 000001CB504D2987

Strings

@, xrefs: 000001CB504D201B
, xrefs: 000001CB504D263F

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction ID: ef794b765cc7b42c884445629445265cd2080923eaaf83b971e0a8999e268e9e
Opcode Fuzzy Hash: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction Fuzzy Hash: 5062F73299CB598BFB689A58E5D6BF9B7F1FBB5310F24021DD887C31D2D724D8028642

Function 000001CB504D1528 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CB504D0600: _getptd.LIBCMT ref: 000001CB504D0616
Part of subcall function 000001CB504D0600: __updatetlocinfo.LIBCMT ref: 000001CB504D064B
Part of subcall function 000001CB504D0600: __updatetmbcinfo.LIBCMT ref: 000001CB504D0672

_errno.LIBCMT ref: 000001CB504D158E

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_fileno.LIBCMT ref: 000001CB504D15BB

Part of subcall function 000001CB504D4A54: _errno.LIBCMT ref: 000001CB504D4A5D
Part of subcall function 000001CB504D4A54: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504D4A68

write_multi_char.LIBCMT ref: 000001CB504D1BEB
write_string.LIBCMT ref: 000001CB504D1C08
write_multi_char.LIBCMT ref: 000001CB504D1C25
write_string.LIBCMT ref: 000001CB504D1C84
write_multi_char.LIBCMT ref: 000001CB504D1CDD
free.LIBCMT ref: 000001CB504D1CF1
_isleadbyte_l.LIBCMT ref: 000001CB504D1DC2
write_char.LIBCMT ref: 000001CB504D1DD8
write_char.LIBCMT ref: 000001CB504D1DF9
_errno.LIBCMT ref: 000001CB504D1EF3
_invalid_parameter_noinfo.LIBCMT ref: 000001CB504D1EFE

Strings

, xrefs: 000001CB504D1BBF

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction ID: e4ed3bad48fa875d74088ba31e0461bf284c756e684f5cc5ef27653095dfb4be
Opcode Fuzzy Hash: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction Fuzzy Hash: FA62193299CA499AF76C9A58A4D6BF9B7F1FB95310F2C021DDC87C32E2D734D8428641

Function 00007FF7B2F31CF4 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7B2F31D10
memset.VCRUNTIME140 ref: 00007FF7B2F31D34
RtlCaptureContext.KERNEL32 ref: 00007FF7B2F31D3D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B2F31D57
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B2F31D98
memset.VCRUNTIME140 ref: 00007FF7B2F31DCB
IsDebuggerPresent.KERNEL32 ref: 00007FF7B2F31DEC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B2F31E09
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B2F31E14

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 8e7c2cf488fdeffeb1694d46fd7392a43ac0c0bfb6156c87c2ec931d69885290
Instruction ID: bf2f7781281fcb3b60dbb6e5c67e18031a61e3fcced75d89bb2ca57860549710
Opcode Fuzzy Hash: 8e7c2cf488fdeffeb1694d46fd7392a43ac0c0bfb6156c87c2ec931d69885290
Instruction Fuzzy Hash: 8E315072A0AB8189EB61AF64E8803EAB360F755749F844039DB4E47B98DF78D548C720

Function 000001CB504C6B38 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001CB504C6CA5
_snprintf.LIBCMT ref: 000001CB504C6D66
_snprintf.LIBCMT ref: 000001CB504C6D83
_snprintf.LIBCMT ref: 000001CB504C6FD8
_snprintf.LIBCMT ref: 000001CB504C70E8
_snprintf.LIBCMT ref: 000001CB504C71A6
_snprintf.LIBCMT ref: 000001CB504C725E
_snprintf.LIBCMT ref: 000001CB504C7002

Part of subcall function 000001CB504CE63C: _errno.LIBCMT ref: 000001CB504CE673
Part of subcall function 000001CB504CE63C: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CE67E

_snprintf.LIBCMT ref: 000001CB504C7276
_snprintf.LIBCMT ref: 000001CB504C7334

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 443ff1d7de2f18c1646300128e04fbef5c6aa181c64e0f6b7c5e49d494fa2957
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: 4A52B03025CD899BF75AAB2CE482BE5F3F0FFA8305F445258D985C7562EB34E5828781

Function 00007FF7B2F31BD4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B2F31C00
GetCurrentThreadId.KERNEL32 ref: 00007FF7B2F31C0E
GetCurrentProcessId.KERNEL32 ref: 00007FF7B2F31C1A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B2F31C2A

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b9449a8907b3bd1365dff25f12a55c9f4cffa051edc1500f507c8a873ef7d653
Instruction ID: 9668285a567fb38f38b748977bd35a2b0bef1ab4bc1f7c4caaf9bedad5affec2
Opcode Fuzzy Hash: b9449a8907b3bd1365dff25f12a55c9f4cffa051edc1500f507c8a873ef7d653
Instruction Fuzzy Hash: DE114F62B19F0189EB00DB64E8543A873A4F76AB59F840A31DB1D47758DF7CD158C390

Function 000001CB504CF1A8 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000001CB504CF1DC

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction ID: d331c64418c77388a44c2d5d94e4cf694f8b35ca5a9ae7bed60045f93e9c7d61
Opcode Fuzzy Hash: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction Fuzzy Hash: B4A1CB71619A098FFF94EF75E898AAA37B2F768301721893A904AC3174DBBCD545CF40

Function 000001CB512A000D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2112258203.000001CB512A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CB512A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1cb512a0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c415b67b43ab89c3885e9d870512453b9488161a6dee6a8c960ce61cfe433965
Instruction ID: a16c801cade22cc28a08d4c4a3360127dcdab51aa9600afdcba81650f11363f1
Opcode Fuzzy Hash: c415b67b43ab89c3885e9d870512453b9488161a6dee6a8c960ce61cfe433965
Instruction Fuzzy Hash: E62138710887494FE301AB649C89EB57BF1EF47324F0982A6E00ACB193EA28D54A8316

Function 000001CB512A0000 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2112258203.000001CB512A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CB512A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1cb512a0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715ecb5e38d05d430620ba6ef99a5c8680024379253057e04e8d960197bd279d
Instruction ID: 63ac60a891f76e60a23733667da726d105ce420db0167d7e94aae108a083f15e
Opcode Fuzzy Hash: 715ecb5e38d05d430620ba6ef99a5c8680024379253057e04e8d960197bd279d
Instruction Fuzzy Hash: 8511297108C7854FD3125B649C89FB4BBF4EF07325F0942EAD05ACB0E3E628844AC356

Function 00007FF7B2F31E98 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3258721700.00007FF7B2F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B2F30000, based on PE: true

Associated: 00000000.00000002.3258706056.00007FF7B2F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258735290.00007FF7B2F33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258747255.00007FF7B2F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3258758877.00007FF7B2F36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b2f30000_N5kEzgUBn6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc3a828de6923606b769fef2bb944386b76cf749a83bf5ce9efce6e6d829fd5
Instruction ID: e2fdcb5d0ed97eb88a2ccd2ca1454cab586697d02100e80f1465cbcec626f528
Opcode Fuzzy Hash: 2fc3a828de6923606b769fef2bb944386b76cf749a83bf5ce9efce6e6d829fd5
Instruction Fuzzy Hash: 7CA00162D0E802A8E706AB58A950521A260AB62B07B850131C20D524689EFDA580C761

Function 000001CB504D5E1C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D5E4E

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__doserrno.LIBCMT ref: 000001CB504D5E45

Part of subcall function 000001CB504D0CA8: _getptd_noexit.LIBCMT ref: 000001CB504D0CAC

__doserrno.LIBCMT ref: 000001CB504D5EAB
_errno.LIBCMT ref: 000001CB504D5EB2
_invalid_parameter_noinfo.LIBCMT ref: 000001CB504D5F16

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction ID: bb32550f0f152c832d3470e13a420bbfe63119c7b29de4eabe9f47145f10cb30
Opcode Fuzzy Hash: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction Fuzzy Hash: D531A33225C6444EF359AF68A8C3BFD36E0EB42320F95065DE456CB2D3DB74D8014391

Function 000001CB504D6C08 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D6C33

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__doserrno.LIBCMT ref: 000001CB504D6C2B

Part of subcall function 000001CB504D0CA8: _getptd_noexit.LIBCMT ref: 000001CB504D0CAC

__lock_fhandle.LIBCMT ref: 000001CB504D6C77
_lseeki64_nolock.LIBCMT ref: 000001CB504D6C90
_unlock_fhandle.LIBCMT ref: 000001CB504D6CB3

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction ID: 48bd055f87820b76baaa063c4affc7d7ebe6228c4800cb14c690d2fbf5391b24
Opcode Fuzzy Hash: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction Fuzzy Hash: C621053266CA044FF358AB5CB8C3BFD72E0EB86721F550249E456C71D3DB64E80142A2

Function 000001CB504D6A90 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D6ABB

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__doserrno.LIBCMT ref: 000001CB504D6AB3

Part of subcall function 000001CB504D0CA8: _getptd_noexit.LIBCMT ref: 000001CB504D0CAC

__lock_fhandle.LIBCMT ref: 000001CB504D6AFF
_lseek_nolock.LIBCMT ref: 000001CB504D6B18
_unlock_fhandle.LIBCMT ref: 000001CB504D6B39

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction ID: 3f2421551f3dd80a2dd002886a6076671d782286afc8725cc0640b21c961788b
Opcode Fuzzy Hash: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction Fuzzy Hash: 3521F43269C6104FF318ABA8E8C3BFD76E1EB82320F55025AE556C72D3D764A8018296

Function 000001CB504D5434 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D545F

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__doserrno.LIBCMT ref: 000001CB504D5457

Part of subcall function 000001CB504D0CA8: _getptd_noexit.LIBCMT ref: 000001CB504D0CAC

__lock_fhandle.LIBCMT ref: 000001CB504D54A3
_unlock_fhandle.LIBCMT ref: 000001CB504D54DD

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction ID: e53b67f24ff857fc5dc4b27c0cb9b1e0c34952e22b00325638d35fbc920613ec
Opcode Fuzzy Hash: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction Fuzzy Hash: 1021E23269C6404FF369AB58F8C3BFD36E1EB82321F650649E056C72D7DB64984182A2

Function 000001CB504D4C58 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D4C79

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__doserrno.LIBCMT ref: 000001CB504D4C71

Part of subcall function 000001CB504D0CA8: _getptd_noexit.LIBCMT ref: 000001CB504D0CAC

__lock_fhandle.LIBCMT ref: 000001CB504D4CBD
_close_nolock.LIBCMT ref: 000001CB504D4CD0
_unlock_fhandle.LIBCMT ref: 000001CB504D4CE9

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction ID: c75e4352737687aba35bd5eb92801fdafffec184f63ab2604cde125af8842736
Opcode Fuzzy Hash: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction Fuzzy Hash: CE21C03319EA044FF315ABA4A8C3BE876E1EB81320F660659E816CB2D3CB74D8008761

Function 000001CB504CEF6C Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001CB504CEF9A

Part of subcall function 000001CB504CE244: _errno.LIBCMT ref: 000001CB504CE264

free.LIBCMT ref: 000001CB504CEFAF
free.LIBCMT ref: 000001CB504CEFD0
free.LIBCMT ref: 000001CB504CEFE5
free.LIBCMT ref: 000001CB504CEFF9
free.LIBCMT ref: 000001CB504CF005
free.LIBCMT ref: 000001CB504CF030
free.LIBCMT ref: 000001CB504CF051
free.LIBCMT ref: 000001CB504CF06A
free.LIBCMT ref: 000001CB504CF09B

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: 6641f16e1d4387e5d68eccf67703c791b1199b2bedf977b1856364322eeafcc4
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 23411E302D9A4A8FFB95EF5AE8D6FE472E1FB54315F6480699005C31E2CB2CD9458711

Function 000001CB504B360C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504B36A9

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

malloc.LIBCMT ref: 000001CB504B36B3

Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE318
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE31D

malloc.LIBCMT ref: 000001CB504B36BE
free.LIBCMT ref: 000001CB504B387E
free.LIBCMT ref: 000001CB504B3886
free.LIBCMT ref: 000001CB504B388E

Part of subcall function 000001CB504B44F0: malloc.LIBCMT ref: 000001CB504B453A
Part of subcall function 000001CB504B44F0: malloc.LIBCMT ref: 000001CB504B4545
Part of subcall function 000001CB504B44F0: free.LIBCMT ref: 000001CB504B462C
Part of subcall function 000001CB504B44F0: free.LIBCMT ref: 000001CB504B4634

free.LIBCMT ref: 000001CB504B389A
free.LIBCMT ref: 000001CB504B38A7
free.LIBCMT ref: 000001CB504B38B4

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction ID: a6f0ca60e9fd81fee7889d9529438adc96e21706a1c6418ac9bfd108875341e7
Opcode Fuzzy Hash: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction Fuzzy Hash: 9B91D87035CB494BFB69AA5DA482BF973E5FB85701F54425EE58AC3283DF20DC068683

Function 000001CB504CEE10 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504CEE36

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001CB504CEE42
__crtIsPackagedApp.LIBCMT ref: 000001CB504CEE53
_dosmaperr.LIBCMT ref: 000001CB504CEE9D

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction ID: deb1d933f1f4615b399b22f7a0c4c3aef11e55c407b9d488d6be187cb99ee6eb
Opcode Fuzzy Hash: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction Fuzzy Hash: F831AC30698A094FF754AF79A8867E976F1FF88351F14856DE44AC32E5D738C8418742

Function 000001CB504D973C Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D9755

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__lock_fhandle.LIBCMT ref: 000001CB504D979D
__doserrno.LIBCMT ref: 000001CB504D97D2
_errno.LIBCMT ref: 000001CB504D97D9
_unlock_fhandle.LIBCMT ref: 000001CB504D97E9

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction ID: 12e6344078b19ac9ca7034d7902f42eb436946a5192a6401b5287e57412ff438
Opcode Fuzzy Hash: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction Fuzzy Hash: D721F2326AC6058EF754AFA8B8D3BED76E0EB41310F55051DE41BC72D2D764DC008362

Function 000001CB504CFB10 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504CFB4C

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001CB504CFB57
memcpy_s.LIBCMT ref: 000001CB504CFC1C
_fileno.LIBCMT ref: 000001CB504CFC87
_filbuf.LIBCMT ref: 000001CB504CFCB5
_errno.LIBCMT ref: 000001CB504CFD05

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: dbe690494bb5442dbc65c2935640b54f89d83c1a933927b7d7b6ff755265e2e3
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: 0961C43126CF090AF76C566CA497BB972E1FF95720F64032EE856C32D5EB64EC5242C1

Function 000001CB504CF620 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504CF577

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001CB504CF582
_getstream.LIBCMT ref: 000001CB504CF5A2
_errno.LIBCMT ref: 000001CB504CF5B4
_errno.LIBCMT ref: 000001CB504CF5C6
_openfile.LIBCMT ref: 000001CB504CF5F4

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction ID: 9853a190bc1915cec7f18fe00fd8f8b2b73aab8267aaaa6ff560d7e3991ac190
Opcode Fuzzy Hash: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction Fuzzy Hash: F621033169CA4A4FF790AB28A483BA976F1FF88300F54096AA845C32A2DF38CC414381

Function 000001CB504C21F4 Relevance: 9.0, APIs: 7, Instructions: 264stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001CB504C222E
strchr.LIBCMT ref: 000001CB504C224C
malloc.LIBCMT ref: 000001CB504C2264
malloc.LIBCMT ref: 000001CB504C2271
rand.LIBCMT ref: 000001CB504C233D
free.LIBCMT ref: 000001CB504C245B
free.LIBCMT ref: 000001CB504C2463

Part of subcall function 000001CB504CE244: _errno.LIBCMT ref: 000001CB504CE264

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$_errnorand
String ID:
API String ID: 2126518082-0
Opcode ID: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction ID: 865792f3f6948bd003040199805d1ea8699a6465581bff0807af230538615f1c
Opcode Fuzzy Hash: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction Fuzzy Hash: 7081E73029CE984BFBA9AB2CA482BF6B3E0FF99305F044169D589C7192DB34C9478741

Function 000001CB504B3170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504B31BD

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

malloc.LIBCMT ref: 000001CB504B31C8

Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE318
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE31D

free.LIBCMT ref: 000001CB504B32AF
free.LIBCMT ref: 000001CB504B32B7
free.LIBCMT ref: 000001CB504B32BF
free.LIBCMT ref: 000001CB504B32CB
free.LIBCMT ref: 000001CB504B32D8

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction ID: 3d435a2ac0a2ecfa34d45764506f83cad0ab4e32fb5d9d9b055fb46de1afbe67
Opcode Fuzzy Hash: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction Fuzzy Hash: 6051B83065CF495BFB6DAB29A492BB977E4FB49301F5041ADD94AC3287EF10EC028685

Function 000001CB504BBA74 Relevance: 7.9, APIs: 6, Instructions: 411COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CB504C4FEC: malloc.LIBCMT ref: 000001CB504C5008

malloc.LIBCMT ref: 000001CB504BBB3B

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

Part of subcall function 000001CB504CB230: malloc.LIBCMT ref: 000001CB504CB29C

Part of subcall function 000001CB504CDAA8: malloc.LIBCMT ref: 000001CB504CDAF8

Part of subcall function 000001CB504CDAA8: realloc.LIBCMT ref: 000001CB504CDB07

malloc.LIBCMT ref: 000001CB504BBC4A
_snprintf.LIBCMT ref: 000001CB504BBCC1
_snprintf.LIBCMT ref: 000001CB504BBCE7
_snprintf.LIBCMT ref: 000001CB504BBD0E
free.LIBCMT ref: 000001CB504BBEC6

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction ID: b4ea86a10a0c29e93a6276590e3c5ce8d2f621861c3d88c3636b4965ffc99097
Opcode Fuzzy Hash: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction Fuzzy Hash: C1D18D3079CA044BFB58BB69A8D7BE972F2FF84301F50452DA546C32D3DF68D9068686

Function 000001CB504C0694 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000001CB504C4FEC: malloc.LIBCMT ref: 000001CB504C5008

Part of subcall function 000001CB504CF620: _errno.LIBCMT ref: 000001CB504CF577
Part of subcall function 000001CB504CF620: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CF582

fseek.LIBCMT ref: 000001CB504C0730

Part of subcall function 000001CB504CFEA4: _errno.LIBCMT ref: 000001CB504CFECC
Part of subcall function 000001CB504CFEA4: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CFED7

_ftelli64.LIBCMT ref: 000001CB504C0738

Part of subcall function 000001CB504CFF18: _errno.LIBCMT ref: 000001CB504CFF36
Part of subcall function 000001CB504CFF18: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CFF41

fseek.LIBCMT ref: 000001CB504C0748

Part of subcall function 000001CB504CFEA4: _fseek_nolock.LIBCMT ref: 000001CB504CFEF5

malloc.LIBCMT ref: 000001CB504C0788

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

fclose.LIBCMT ref: 000001CB504C0845

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction ID: 2b1bc31cf230401e4d2a6442d75c086988e47f86bfc0799ee1dcaf0a534e7e4c
Opcode Fuzzy Hash: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction Fuzzy Hash: B151713165CA484BF749EB28A4D7BF972E1FB88310F50426EA54BC32D7DF24D90286C1

Function 000001CB504D9348 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001CB504D9375

Part of subcall function 000001CB504D2E58: _FF_MSGBANNER.LIBCMT ref: 000001CB504D2E75
Part of subcall function 000001CB504D2E58: _NMSG_WRITE.LIBCMT ref: 000001CB504D2E7F

_lock.LIBCMT ref: 000001CB504D9388
_lock.LIBCMT ref: 000001CB504D93E3
_calloc_crt.LIBCMT ref: 000001CB504D949A

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction ID: c40bc50a9912481cec2cb723978ff8dc9dd5aa774acccc63489c636c71cabcc0
Opcode Fuzzy Hash: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction Fuzzy Hash: 1C51D57255CA088BF7549F18E8C67AAB7E0FB58314F11465DE84BC72A2D774DC428B82

Function 000001CB504B44F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504B453A

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

malloc.LIBCMT ref: 000001CB504B4545

Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE318
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE31D

free.LIBCMT ref: 000001CB504B462C
free.LIBCMT ref: 000001CB504B4634
free.LIBCMT ref: 000001CB504B4640
free.LIBCMT ref: 000001CB504B464D

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction ID: b24aa8b0927f9e6c3b5f5076d79264bc2cf1f9324b4d7ffbe00e1c2a5cd54208
Opcode Fuzzy Hash: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction Fuzzy Hash: B941E43139CB4D0BFB689A296882BBA73E5EBD6311F14416DD987C3283EF24D8074781

Function 000001CB504D139C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001CB504D13B9

Part of subcall function 000001CB504D4A54: _errno.LIBCMT ref: 000001CB504D4A5D
Part of subcall function 000001CB504D4A54: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504D4A68

_errno.LIBCMT ref: 000001CB504D13C9

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_errno.LIBCMT ref: 000001CB504D13E5
_isatty.LIBCMT ref: 000001CB504D1446
_getbuf.LIBCMT ref: 000001CB504D1452

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction ID: d3579fe7db0df4bce9cf3c318265b63422515e970a62415cd46dbc2b2f6a2ef1
Opcode Fuzzy Hash: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction Fuzzy Hash: EA519032258A085FFB98EF68D4D2BE577F1EB48310F580299DC5ACB2E6D774D8818781

Function 000001CB504C8220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504C824F

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

_snprintf.LIBCMT ref: 000001CB504C8267

Part of subcall function 000001CB504CE63C: _errno.LIBCMT ref: 000001CB504CE673
Part of subcall function 000001CB504CE63C: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CE67E

free.LIBCMT ref: 000001CB504C827E

Part of subcall function 000001CB504CE244: _errno.LIBCMT ref: 000001CB504CE264

malloc.LIBCMT ref: 000001CB504C82CE
_snprintf.LIBCMT ref: 000001CB504C82E6
free.LIBCMT ref: 000001CB504C830E

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction ID: ce2a7ff36fdf9586e1cc08bcf0b397a2ec592e8d5cdd59947552c2118f18aede
Opcode Fuzzy Hash: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction Fuzzy Hash: F841913034CA880FF698AB2C7456BF877E2FB99310F44929DD48EC3296DB24DC024781

Function 000001CB504BEC64 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504BEC85

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

free.LIBCMT ref: 000001CB504BECC0
fwrite.LIBCMT ref: 000001CB504BED01
fclose.LIBCMT ref: 000001CB504BED09
free.LIBCMT ref: 000001CB504BED16

Part of subcall function 000001CB504CE244: _errno.LIBCMT ref: 000001CB504CE264

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction ID: 7edc1d79b95abe27094e33ccbb620951b6173ddea45faf6d8a9ba591c4ecc471
Opcode Fuzzy Hash: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction Fuzzy Hash: 4E21B83025CA480BFB94FB2DA096BEEB2E1FFD8300F54455D614AC32C2DF24C9018382

Function 000001CB504D95EC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504D95FD

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

__doserrno.LIBCMT ref: 000001CB504D95F5

Part of subcall function 000001CB504D0CA8: _getptd_noexit.LIBCMT ref: 000001CB504D0CAC

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: b101ba8caaf207f1db14ab3e8fcf3db358881e5ffd127770a8aa6c09dc461c75
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: A301A4322AC9484EF699A774D8D7BEC32B0FF11325FA44255E406C71E6DB78D8418712

Function 000001CB504BDC04 Relevance: 6.5, APIs: 5, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001CB504BDCD3
_snprintf.LIBCMT ref: 000001CB504BDCFE
_snprintf.LIBCMT ref: 000001CB504BDD1A
_snprintf.LIBCMT ref: 000001CB504BDDCF
_snprintf.LIBCMT ref: 000001CB504BDDE6

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 03cbeca6430d3a60b4a97a3124c22e1e93002b7c16ca70d83009c4fbf0cf4ec1
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 05917F3025CA488FFB54EF18E8C6BEA73F5FBA5304F004569E446C3192EB38D9458B41

Function 000001CB504CDFEC Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504CE00F

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

malloc.LIBCMT ref: 000001CB504CE01D

Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE318
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE31D

malloc.LIBCMT ref: 000001CB504CE03F
_snprintf.LIBCMT ref: 000001CB504CE05A

Part of subcall function 000001CB504CE63C: _errno.LIBCMT ref: 000001CB504CE673
Part of subcall function 000001CB504CE63C: _invalid_parameter_noinfo.LIBCMT ref: 000001CB504CE67E

malloc.LIBCMT ref: 000001CB504CE075

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction ID: 42a0b708c85351e76e4d39fae0d99f28583e278f1c8778c65087646eefa05d9c
Opcode Fuzzy Hash: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction Fuzzy Hash: A5114F7165CB044FE7A8AF69A4867A576E1FB88310F10459EE08AC3296EB34D84247C1

Function 000001CB504CF62C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504CF664

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001CB504CF66F
_flush.LIBCMT ref: 000001CB504CF721
_fileno.LIBCMT ref: 000001CB504CF742

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction ID: 334934cdd17a49507d61adc00ac90329de61a916eb083f168d4c25f91a07efe4
Opcode Fuzzy Hash: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction Fuzzy Hash: 6551D53035DF094BF6686A6D74C7BB572E1FF58310F24422ED89AC31E2EB65DC528286

Function 000001CB504B00D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001CB504B0117
clock.LIBCMT ref: 000001CB504B0124
clock.LIBCMT ref: 000001CB504B012D
clock.LIBCMT ref: 000001CB504B013A

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: d108db115a32650e6b2c63de020533b648bbb930f0de7e2697f9f133211c5548
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 4421C67244C70C4EFB6CAD9C68C3AB6B6E0D795351F15422DEACAC3143FA51DC4282D6

Function 000001CB504CF0EC Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000001CB504CF109

Part of subcall function 000001CB504D3540: _FindPESection.LIBCMT ref: 000001CB504D3569

_initp_misc_cfltcvt_tab.LIBCMT ref: 000001CB504CF11A
_initterm_e.LIBCMT ref: 000001CB504CF12D
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CB504CF176

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 4030f444e10e83babf63ca456711778ffaca7bb986e35c3fe88b540d1c4421cc
Instruction ID: ac470db56e57c44d07478b7ab2ac319b02fb7c54ba96768157c7235d0a8cc5be
Opcode Fuzzy Hash: 4030f444e10e83babf63ca456711778ffaca7bb986e35c3fe88b540d1c4421cc
Instruction Fuzzy Hash: 96115132198D09CAFB5AAB60FDD7BE673B5FB54301F4845699402C70E2EF38DE448640

Function 000001CB504B0CC4 Relevance: 5.4, APIs: 4, Instructions: 410COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001CB504B0D6A

Part of subcall function 000001CB504DDE08: _calloc_impl.LIBCMT ref: 000001CB504DDE18
Part of subcall function 000001CB504DDE08: _errno.LIBCMT ref: 000001CB504DDE2B
Part of subcall function 000001CB504DDE08: _errno.LIBCMT ref: 000001CB504DDE35

free.LIBCMT ref: 000001CB504B0EF3
free.LIBCMT ref: 000001CB504B0EFD

Part of subcall function 000001CB504CE244: _errno.LIBCMT ref: 000001CB504CE264

free.LIBCMT ref: 000001CB504B0F0F

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errnofree$_calloc_implcalloc
String ID:
API String ID: 1251419800-0
Opcode ID: d93992b633c35f2e37b516dd72fb4d9a33d59668b61f8d19e3ffcf9038676577
Instruction ID: 54fc0d027810b8320a4c6b78899b7c68da672fc8c2ab43c943c429539c54af0f
Opcode Fuzzy Hash: d93992b633c35f2e37b516dd72fb4d9a33d59668b61f8d19e3ffcf9038676577
Instruction Fuzzy Hash: C7E11970658B488FEBA8DF5CD485BAABBF1FB98305F10452EE58DC3291DB70D8458B42

Function 000001CB504CE860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CB504CE8B1

Part of subcall function 000001CB504D0D18: _getptd_noexit.LIBCMT ref: 000001CB504D0D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001CB504CE8BC

Strings

B, xrefs: 000001CB504CE8E8

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 721f6edfe15ddefe8e50a166596dba437ce19f97ae28426df2231c7d640403a0
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 1411B231258B084FF754EF59E486BA9B3E1FB98324F60476EA419C32A1CB34C844C782

Function 000001CB504C9D44 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504C9D78

Part of subcall function 000001CB504CE284: _FF_MSGBANNER.LIBCMT ref: 000001CB504CE2B4
Part of subcall function 000001CB504CE284: _NMSG_WRITE.LIBCMT ref: 000001CB504CE2BE
Part of subcall function 000001CB504CE284: _callnewh.LIBCMT ref: 000001CB504CE2F2
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE2FD
Part of subcall function 000001CB504CE284: _errno.LIBCMT ref: 000001CB504CE308

free.LIBCMT ref: 000001CB504C9EBF
free.LIBCMT ref: 000001CB504C9F23
free.LIBCMT ref: 000001CB504C9F2F

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction ID: 19fc17724306b906cfe4736a8160a5b4475aefcb3ca06ab93e0a2bd151afb3d8
Opcode Fuzzy Hash: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction Fuzzy Hash: F161703029CA194BFA68AB28A4DBBFD72E1FF98340F10496DA547C3197DF24D9428685

Function 000001CB504B3300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CB504B3363

Memory Dump Source

Source File: 00000000.00000002.3258424474.000001CB504B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CB504B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cb504b0000_N5kEzgUBn6.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction ID: eb37872fb4165f447054343b2fc2ddfc47918caca6c49ac2d0f543a03a66632b
Opcode Fuzzy Hash: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction Fuzzy Hash: 3E51B33065CA454BFF699F2DA4C2AAA73E1FB85301F00456DE94BC3287EF20EC068681

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report N5kEzgUBn6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
N5kEzgUBn6.exe

Function 00007FF7B2F31130 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 161
librarymemoryloaderCOMMON

Function 000001CB4EDB010C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 203
networkCOMMON

Function 000001CB4EDB012B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99
networkmemoryfileCOMMON

Function 000001CB504C4E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 000001CB4F1A0000 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Function 00007FF7B2F313D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 73
libraryloaderwindowCOMMON

Function 00007FF7B2F3164C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Function 000001CB504BD68C Relevance: 7.8, APIs: 5, Instructions: 260
networkCOMMONLIBRARYCODE

Function 000001CB504BE014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 00007FF7B2F31070 Relevance: 3.0, APIs: 2, Instructions: 46
memoryCOMMON

Function 000001CB504CC3B8 Relevance: 1.6, APIs: 1, Instructions: 122
memoryCOMMONLIBRARYCODE

Function 000001CB504CC1C8 Relevance: 1.4, APIs: 1, Instructions: 121
memoryCOMMONLIBRARYCODE

Function 000001CB504CC2EC Relevance: 1.3, APIs: 1, Instructions: 75
COMMONLIBRARYCODE