Edit tour

Windows Analysis Report
R4WCgDAfHB.exe

Overview

General Information

Sample name:	R4WCgDAfHB.exe renamed because original name is a hash value
Original sample name:	8595a9cecbac3bd363c30c7ab2bec849.exe
Analysis ID:	1532151
MD5:	8595a9cecbac3bd363c30c7ab2bec849
SHA1:	5a154a7472cc4afa18f414a3edf8f3ff7a2a51e2
SHA256:	df2b80bb68e829de13051a9781e096b095a90b676ab1f974284bad8609775040
Tags:	exeuser-abuse_ch
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Deletes itself after installation

Drops HTML or HTM files to system directories

Drops executables to the windows directory (C:\Windows) and starts them

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Suspicious Epmap Connection

Uses dynamic DNS services

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

R4WCgDAfHB.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\R4WCgDAfHB.exe" MD5: 8595A9CECBAC3BD363C30C7AB2BEC849)

NvwmiShell.exe (PID: 7360 cmdline: "C:\Windows\SystemNvwmiShell\NvwmiShell.exe" MD5: FC4FBC1A020E2DC3D073C666684B5C6A)

NvwmiShell.exe (PID: 7380 cmdline: C:\Windows\SystemNvwmiShell\NvwmiShell.exe MD5: FC4FBC1A020E2DC3D073C666684B5C6A)

cmd.exe (PID: 8060 cmdline: "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8124 cmdline: netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

HelpSystem.exe (PID: 4296 cmdline: "C:\Program Files (x86)\Microsoft Network\HelpSystem.exe" 1 MD5: 34B640C3E7AE045FE1F156B755BB0BE7)

conhost.exe (PID: 3844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Network64.exe (PID: 2996 cmdline: "C:\Program Files (x86)\Microsoft Network\Network64.exe" Yde5fFJFjShqKS+u9okdyvP/pj9kg/bQNXV+USrRGaecQs8AdtikoR9wVLreBlqoPAFr/LRRDydtLzX5YzQgQ1GCivTcd3opL1Xfv4SzrZQOBZVgTwOiPgknymhzPAuX3kaHX0i00NQybzCyaJaj7nJOK0DHJVp09YDF1A== MD5: A09B6784FF89670772817524BFE41A76)

conhost.exe (PID: 180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.4141872839.00000000009EA000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000001.2805127434.0000000000401000.00000020.00000001.01000000.00000009.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13ded8:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
0000000C.00000000.2804854911.00000000009EA000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000002.4141120724.0000000000401000.00000020.00000001.01000000.00000009.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13ded8:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
0000000C.00000000.2804283551.0000000000401000.00000020.00000001.01000000.00000009.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13ded8:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
00000002.00000003.2738458849.0000000002163000.00000004.00000020.00020000.00000000.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x1531f7:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
Process Memory Space: NvwmiShell.exe PID: 7380	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Network64.exe PID: 2996	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.HelpSystem.exe.400000.0.unpack	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x51390:$x1: Microsoft? Windows? Operating System 0x9938:$s1: GetLastActivePopup 0x3c1b3:$s2: Sleep 0x3c1e0:$s3: GetModuleFileName 0x3c017:$s4: VirtualProtect 0x5163c:$s4: VirtualProtect 0x3c087:$s5: HeapAlloc 0x3c06a:$s6: GetProcessHeap 0x3c0c2:$s7: GetCommandLine
2.3.NvwmiShell.exe.217731f.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
2.3.NvwmiShell.exe.217731f.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x6408d9:$s1: %s/%s (Windows NT %lu.%lu 0x645148:$s3: \\.\WinRing0_ 0x5edb1a:$s4: pool_wallet 0x5ea5a0:$s5: cryptonight 0x5ea5ae:$s5: cryptonight 0x5ea5bd:$s5: cryptonight 0x5ea5cb:$s5: cryptonight 0x5ea5e0:$s5: cryptonight 0x5ea5ef:$s5: cryptonight 0x5ea5fd:$s5: cryptonight 0x5ea612:$s5: cryptonight 0x5ea621:$s5: cryptonight 0x5ea632:$s5: cryptonight 0x5ea649:$s5: cryptonight 0x5ea657:$s5: cryptonight 0x5ea665:$s5: cryptonight 0x5ea675:$s5: cryptonight 0x5ea687:$s5: cryptonight 0x5ea698:$s5: cryptonight 0x5ea6a8:$s5: cryptonight 0x5ea6b8:$s5: cryptonight
12.0.Network64.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
12.0.Network64.exe.400000.0.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13eed8:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
12.0.Network64.exe.400000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x6408d9:$s1: %s/%s (Windows NT %lu.%lu 0x645148:$s3: \\.\WinRing0_ 0x5edb1a:$s4: pool_wallet 0x5ea5a0:$s5: cryptonight 0x5ea5ae:$s5: cryptonight 0x5ea5bd:$s5: cryptonight 0x5ea5cb:$s5: cryptonight 0x5ea5e0:$s5: cryptonight 0x5ea5ef:$s5: cryptonight 0x5ea5fd:$s5: cryptonight 0x5ea612:$s5: cryptonight 0x5ea621:$s5: cryptonight 0x5ea632:$s5: cryptonight 0x5ea649:$s5: cryptonight 0x5ea657:$s5: cryptonight 0x5ea665:$s5: cryptonight 0x5ea675:$s5: cryptonight 0x5ea687:$s5: cryptonight 0x5ea698:$s5: cryptonight 0x5ea6a8:$s5: cryptonight 0x5ea6b8:$s5: cryptonight
12.2.Network64.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
12.2.Network64.exe.400000.0.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13eed8:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
12.2.Network64.exe.400000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x6408d9:$s1: %s/%s (Windows NT %lu.%lu 0x645148:$s3: \\.\WinRing0_ 0x5edb1a:$s4: pool_wallet 0x5ea5a0:$s5: cryptonight 0x5ea5ae:$s5: cryptonight 0x5ea5bd:$s5: cryptonight 0x5ea5cb:$s5: cryptonight 0x5ea5e0:$s5: cryptonight 0x5ea5ef:$s5: cryptonight 0x5ea5fd:$s5: cryptonight 0x5ea612:$s5: cryptonight 0x5ea621:$s5: cryptonight 0x5ea632:$s5: cryptonight 0x5ea649:$s5: cryptonight 0x5ea657:$s5: cryptonight 0x5ea665:$s5: cryptonight 0x5ea675:$s5: cryptonight 0x5ea687:$s5: cryptonight 0x5ea698:$s5: cryptonight 0x5ea6a8:$s5: cryptonight 0x5ea6b8:$s5: cryptonight
2.3.NvwmiShell.exe.217731f.0.raw.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13eed8:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
2.3.NvwmiShell.exe.21630df.3.raw.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x153118:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Epmap Connection

Source: Network Connection

Author: frack113, Tim Shelton (fps): Data: DestinationIp: 192.168.2.1, DestinationIsIpv6: false, DestinationPort: 135, EventID: 3, Image: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe, Initiated: true, ProcessId: 4296, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 50574

Suricata Signatures

ETPRO MALWARE Observed Malicious User-Agent (WinInetGet/)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T16:39:54.910290+0200	2830483	1	A Network Trojan was detected	192.168.2.4	50024	114.215.199.192	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: R4WCgDAfHB.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Avira: detection malicious, Label: TR/Agent.fvzxi
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Avira: detection malicious, Label: TR/CoinMiner.ivyoo

Multi AV Scanner detection for domain / URL

Source: contr.netmows.com	Virustotal: Detection: 5%			Perma Link
Source: http://appbols.vivoios.com:8587/smb.exe	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for submitted file

Source: R4WCgDAfHB.exe	ReversingLabs: Detection: 81%
Source: R4WCgDAfHB.exe	Virustotal: Detection: 79%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: R4WCgDAfHB.exe

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.0.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.0:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.102:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.0.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.0:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.102:445	Jump to behavior

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 2.3.NvwmiShell.exe.217731f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Network64.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Network64.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4141872839.00000000009EA000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2804854911.00000000009EA000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NvwmiShell.exe PID: 7380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Network64.exe PID: 2996, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: stratum+ssl://
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: R4WCgDAfHB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: R4WCgDAfHB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, WinRing0x64.sys.2.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2830483 - Severity 1 - ETPRO MALWARE Observed Malicious User-Agent (WinInetGet/) : 192.168.2.4:50024 -> 114.215.199.192:80

Uses dynamic DNS services

Source: unknown

DNS query: name: ddns.oray.com

Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 45.137.222.18:8686
Source: global traffic	TCP traffic: 192.168.2.4:50036 -> 141.255.164.11:5582

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10004960 select,__WSAFDIsSet,recv,

1_3_10004960

Source: global traffic

HTTP traffic detected: GET /checkip HTTP/1.1User-Agent: WinInetGet/0.1Host: ddns.oray.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: contr.netmows.com
Source: global traffic	DNS traffic detected: DNS query: ddns.oray.com
Source: global traffic	DNS traffic detected: DNS query: pool.autocoreb.com

Source: HelpSystem.exe, HelpSystem.exe, 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://appbols.vivoios.com:8587/smb.exe
Source: HelpSystem.exe, 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://appbols.vivoios.com:8587/smb.exeX
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: NvwmiShell.exe, 00000002.00000003.2781877794.0000000004970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesi
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000003F70000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000004970000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000005370000.00000004.00000020.00020000.00000000.sdmp, HelpSystem.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, WinRing0x64.sys.2.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, WinRing0x64.sys.2.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, WinRing0x64.sys.2.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, WinRing0x64.sys.2.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: HelpSystem.exe, 0000000A.00000002.4141453934.000000000069A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddns.oray.com/checkip
Source: HelpSystem.exe, 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ddns.oray.com/checkip(
Source: HelpSystem.exe, 0000000A.00000002.4141453934.000000000069A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddns.oray.com/checkip7
Source: HelpSystem.exe, 0000000A.00000002.4141453934.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddns.oray.com/checkipSystem32
Source: HelpSystem.exe, 0000000A.00000002.4141453934.000000000069A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddns.oray.com/checkipl
Source: NvwmiShell.exe, 00000002.00000003.2781877794.0000000003F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.global
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000003F70000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000004970000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000005370000.00000004.00000020.00020000.00000000.sdmp, HelpSystem.exe.2.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: NvwmiShell.exe, 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000003F70000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000004970000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, NvwmiShell.exe, 00000002.00000003.2781877794.0000000005370000.00000004.00000020.00020000.00000000.sdmp, HelpSystem.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://sf.symcd.com0&
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://www.360.cn
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: NvwmiShell.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: R4WCgDAfHB.exe, HelpSystem.exe.2.dr, NvwmiShell.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/03

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_2_008891F1 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,

1_2_008891F1

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.HelpSystem.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: 2.3.NvwmiShell.exe.217731f.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 12.0.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 12.0.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 12.2.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 12.2.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 2.3.NvwmiShell.exe.217731f.0.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 2.3.NvwmiShell.exe.21630df.3.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 0000000C.00000001.2805127434.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 0000000C.00000002.4141120724.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 0000000C.00000000.2804283551.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 00000002.00000003.2738458849.0000000002163000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown

Source: C:\Program Files (x86)\Microsoft Network\Network64.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

File created: C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	File created: C:\Windows\SystemNvwmiShell	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	File created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	File created: C:\Windows\SystemNvwmiShell\NvwmiShell.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\checkip[1].htm	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

File deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\checkip[1].htm

Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_1000ED13	1_3_1000ED13
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_10007245	1_3_10007245
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_1000F257	1_3_1000F257
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_1001065D	1_3_1001065D
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_10002B00	1_3_10002B00
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_1000AF8B	1_3_1000AF8B
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_1000F79B	1_3_1000F79B
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_008908D8	1_2_008908D8
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_008900F8	1_2_008900F8
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0089C283	1_2_0089C283
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0088AA49	1_2_0088AA49
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0089E3F1	1_2_0089E3F1
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_008904CC	1_2_008904CC
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_00890CF8	1_2_00890CF8
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0089D403	1_2_0089D403
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0088FC23	1_2_0088FC23
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0089CD0B	1_2_0089CD0B
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0089C7C7	1_2_0089C7C7
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_00892769	1_2_00892769
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_00402D3A	10_2_00402D3A
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_10006BB9	10_2_10006BB9

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: String function: 0088F10F appears 66 times
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: String function: 008912C0 appears 44 times
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: String function: 10007180 appears 31 times

Source: R4WCgDAfHB.exe

Static PE information: invalid certificate

Source: R4WCgDAfHB.exe, 00000000.00000000.1682546809.00000000003EC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNvwmi64.exeH vs R4WCgDAfHB.exe
Source: R4WCgDAfHB.exe, 00000000.00000003.1691860964.00000000031FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNvwmi64.exeH vs R4WCgDAfHB.exe
Source: R4WCgDAfHB.exe, 00000000.00000003.1718951677.0000000007D76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNvwmi64.exeH vs R4WCgDAfHB.exe
Source: R4WCgDAfHB.exe	Binary or memory string: OriginalFilenameNvwmi64.exeH vs R4WCgDAfHB.exe

Source: R4WCgDAfHB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.HelpSystem.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: 2.3.NvwmiShell.exe.217731f.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 12.0.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 12.0.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 12.2.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 12.2.Network64.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 2.3.NvwmiShell.exe.217731f.0.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 2.3.NvwmiShell.exe.21630df.3.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 0000000C.00000001.2805127434.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 0000000C.00000002.4141120724.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 0000000C.00000000.2804283551.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 00000002.00000003.2738458849.0000000002163000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16

Source: WinRing0x64.sys.2.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.troj.expl.evad.mine.winEXE@15/8@6/100

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_100016E0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		1_3_100016E0
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_10002800 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		10_2_10002800

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: _memset,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,UnlockServiceDatabase,StartServiceA,GetLastError,OpenServiceA,StartServiceA,StartServiceA,RegOpenKeyA,lstrlen,RegSetValueExA,RegCloseKey,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

1_3_100019D0

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_2_00882035 FindResourceA,

1_2_00882035

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_100019D0 _memset,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,UnlockServiceDatabase,StartServiceA,GetLastError,OpenServiceA,StartServiceA,StartServiceA,RegOpenKeyA,lstrlen,RegSetValueExA,RegCloseKey,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

1_3_100019D0

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10001D30 Sleep,StartServiceCtrlDispatcherA,

1_3_10001D30

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

File created: C:\Program Files (x86)\Microsoft Network

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:180:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

Command line argument: X@

10_2_00405830

Source: R4WCgDAfHB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: R4WCgDAfHB.exe	ReversingLabs: Detection: 81%
Source: R4WCgDAfHB.exe	Virustotal: Detection: 79%

Source: Network64.exe	String found in binary or memory: --help
Source: Network64.exe	String found in binary or memory: --help
Source: Network64.exe	String found in binary or memory: rget,jit_inst,jit_prefetch_vgpr_index,jit_vmcnt,batch_size); if(p-start_p>size_limit) { (p++)=S_SETPC_B64_S12_13; return p; } } while (!done); } (p++)=S_SETPC_B64_S12_13; return p; } __attribute__((reqd_work_group_size(64,1,1))) __kernel void randomx_jit(_

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

File read: C:\Users\user\Desktop\R4WCgDAfHB.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\R4WCgDAfHB.exe "C:\Users\user\Desktop\R4WCgDAfHB.exe"
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe "C:\Windows\SystemNvwmiShell\NvwmiShell.exe"
Source: unknown	Process created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe C:\Windows\SystemNvwmiShell\NvwmiShell.exe
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe "C:\Program Files (x86)\Microsoft Network\HelpSystem.exe" 1
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Program Files (x86)\Microsoft Network\Network64.exe "C:\Program Files (x86)\Microsoft Network\Network64.exe" Yde5fFJFjShqKS+u9okdyvP/pj9kg/bQNXV+USrRGaecQs8AdtikoR9wVLreBlqoPAFr/LRRDydtLzX5YzQgQ1GCivTcd3opL1Xfv4SzrZQOBZVgTwOiPgknymhzPAuX3kaHX0i00NQybzCyaJaj7nJOK0DHJVp09YDF1A==
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe "C:\Windows\SystemNvwmiShell\NvwmiShell.exe"	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe "C:\Program Files (x86)\Microsoft Network\HelpSystem.exe" 1	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Program Files (x86)\Microsoft Network\Network64.exe "C:\Program Files (x86)\Microsoft Network\Network64.exe" Yde5fFJFjShqKS+u9okdyvP/pj9kg/bQNXV+USrRGaecQs8AdtikoR9wVLreBlqoPAFr/LRRDydtLzX5YzQgQ1GCivTcd3opL1Xfv4SzrZQOBZVgTwOiPgknymhzPAuX3kaHX0i00NQybzCyaJaj7nJOK0DHJVp09YDF1A==	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"	Jump to behavior

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Section loaded: nlaapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: R4WCgDAfHB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: R4WCgDAfHB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: R4WCgDAfHB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: R4WCgDAfHB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: R4WCgDAfHB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: R4WCgDAfHB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10001C50 LoadLibraryW,GetProcAddress,FreeLibrary,

1_3_10001C50

Source: R4WCgDAfHB.exe

Static PE information: real checksum: 0x65ed9 should be: 0x67b71

Source: Network64.exe.2.dr

Static PE information: section name: .xdata

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_10007851 push ecx; ret	1_3_10007864
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_10017D60 push ebx; retf	1_3_10017D69
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_100171E8 push eax; iretd	1_3_100171E9
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_10021F82 push 86867811h; iretd	1_3_10021F87
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0088F1E7 push ecx; ret	1_2_0088F1FA
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_00891305 push ecx; ret	1_2_00891318
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_00403461 push ecx; ret	10_2_00403474
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_0043C7FE push eax; iretd	10_2_0043C800
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_1000C574 push ecx; ret	10_2_1000C587
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_100071C5 push ecx; ret	10_2_100071D8

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops HTML or HTM files to system directories

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\checkip[1].htm

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

Executable created and started: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

File created: C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	File created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Jump to dropped file
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	File created: C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys	Jump to dropped file
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	File created: C:\Program Files (x86)\Microsoft Network\Network64.exe	Jump to dropped file
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	File created: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Jump to dropped file

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

File created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Jump to dropped file

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetCellcore NvwmiShells

Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetCellcore NvwmiShells

Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

1_3_100019D0

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

File deleted: c:\users\user\desktop\r4wcgdafhb.exe

Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_2_00886B5A IsIconic,GetWindowPlacement,GetWindowRect,

1_2_00886B5A

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Microsoft Network\Network64.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

Code function: _malloc,GetAdaptersInfo,_malloc,lstrlen,GetAdaptersInfo,

10_2_10003100

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Thread delayed: delay time: 3600000

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Window / User API: threadDelayed 641	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 4817	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe	Window / User API: threadDelayed 9098	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe	Window / User API: threadDelayed 892	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_10-10890

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Dropped PE file which has not been started: C:\Windows\SystemNvwmiShell\NvwmiShell.exe			Jump to dropped file
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys			Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_10-11211
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_1-14838
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_1-14936
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_10-9984

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 7416	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 7412	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 7412	Thread sleep time: -421200000s >= -30000s	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 8072	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 8072	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 6752	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe TID: 6752	Thread sleep time: -53000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe TID: 5592	Thread sleep count: 641 > 30	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe TID: 5940	Thread sleep count: 9098 > 30	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe TID: 3300	Thread sleep count: 892 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Microsoft Network\Network64.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Thread delayed: delay time: 3600000

Jump to behavior

Source: Network64.exe, 0000000C.00000002.4142356939.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: HelpSystem.exe, 0000000A.00000002.4141453934.00000000006E2000.00000004.00000020.00020000.00000000.sdmp, HelpSystem.exe, 0000000A.00000002.4141453934.000000000069A000.00000004.00000020.00020000.00000000.sdmp, Network64.exe, 0000000C.00000002.4142356939.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Network64.exe, 0000000C.00000002.4142356939.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HelpSystem.exe, 0000000A.00000002.4141453934.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx<

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	API call chain: ExitProcess graph end node			graph_1-14937
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	API call chain: ExitProcess graph end node			graph_10-9986

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10006718 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_3_10006718

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10001C50 LoadLibraryW,GetProcAddress,FreeLibrary,

1_3_10001C50

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10002840 FreeLibrary,FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,

1_3_10002840

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_10006718 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_3_10006718
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_1000FF2F _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_3_1000FF2F
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_3_100053BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_3_100053BA
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_00893AAA SetUnhandledExceptionFilter,	1_2_00893AAA
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_00897AEE __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00897AEE
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_008953AB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_008953AB
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: 1_2_0088E5F7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0088E5F7
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_00402033 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00402033
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_004078F8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__amsg_exit,	10_2_004078F8
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_00405085 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00405085
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_00403CAE SetUnhandledExceptionFilter,	10_2_00403CAE
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_1000628F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_1000628F
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_10003C98 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_10003C98
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: 10_2_1000C59A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_1000C59A

Source: C:\Users\user\Desktop\R4WCgDAfHB.exe	Process created: C:\Windows\SystemNvwmiShell\NvwmiShell.exe "C:\Windows\SystemNvwmiShell\NvwmiShell.exe"	Jump to behavior
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"	Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	1_2_00882175
Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe	Code function: GetLocaleInfoA,	1_2_0089BF26
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: GetLocaleInfoA,	10_2_00407A18
Source: C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	Code function: GetLocaleInfoA,	10_2_1000D85B

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_1000516E GetSystemTimeAsFileTime,__aulldiv,

1_3_1000516E

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Code function: 1_3_10001CA0 _memset,GetVersionExA,

1_3_10001CA0

Source: C:\Program Files (x86)\Microsoft Network\Network64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	33 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	33 Windows Service	21 Obfuscated Files or Information	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 Software Packing	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	121 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
R4WCgDAfHB.exe	82%	ReversingLabs	Win32.Downloader.Farfli
R4WCgDAfHB.exe	79%	Virustotal		Browse
R4WCgDAfHB.exe	100%	Avira	TR/CoinMiner.acjmz
R4WCgDAfHB.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	100%	Avira	TR/Agent.fvzxi
C:\Windows\SystemNvwmiShell\NvwmiShell.exe	100%	Avira	TR/CoinMiner.ivyoo
C:\Program Files (x86)\Microsoft Network\HelpSystem.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys	5%	ReversingLabs
C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys	4%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ddns.oray.com	0%	Virustotal	Browse
contr.netmows.com	5%	Virustotal	Browse
pool.autocoreb.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ddns.oray.com/checkipl	0%	Virustotal		Browse
http://ocsp.global	0%	Virustotal		Browse
http://appbols.vivoios.com:8587/smb.exeX	3%	Virustotal		Browse
http://ddns.oray.com/checkip(	0%	Virustotal		Browse
http://www.360.cn	0%	Virustotal		Browse
http://appbols.vivoios.com:8587/smb.exe	9%	Virustotal		Browse
http://ddns.oray.com/checkip	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ddns.oray.com	114.215.199.192	true	true	0%, Virustotal, Browse	unknown
contr.netmows.com	45.137.222.18	true	false	5%, Virustotal, Browse	unknown
pool.autocoreb.com	116.202.251.6	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddns.oray.com/checkip	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ddns.oray.com/checkipl	HelpSystem.exe, 0000000A.00000002.4141453934.000000000069A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ddns.oray.com/checkip(	HelpSystem.exe, 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ocsp.global	NvwmiShell.exe, 00000002.00000003.2781877794.0000000003F70000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ddns.oray.com/checkip7	HelpSystem.exe, 0000000A.00000002.4141453934.000000000069A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.360.cn	R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://www.symauth.com/cps0(	R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	R4WCgDAfHB.exe, NvwmiShell.exe.0.dr	false	URL Reputation: safe	unknown
http://appbols.vivoios.com:8587/smb.exeX	HelpSystem.exe, 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
http://appbols.vivoios.com:8587/smb.exe	HelpSystem.exe, HelpSystem.exe, 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
http://ddns.oray.com/checkipSystem32	HelpSystem.exe, 0000000A.00000002.4141453934.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.148
192.168.4.67
192.168.2.149
192.168.4.68
192.168.2.146
192.168.4.65
192.168.2.147
192.168.4.66
192.168.12.127
192.168.12.128
192.168.4.69
192.168.12.129
192.168.2.140
192.168.12.123
192.168.2.141
192.168.4.60
192.168.12.124
192.168.12.125
192.168.12.126
192.168.2.144
192.168.4.63
192.168.2.145
192.168.4.64
192.168.12.120
192.168.2.142
192.168.4.61
192.168.12.121
192.168.2.143
192.168.4.62
192.168.12.122
192.168.2.159
192.168.4.56
192.168.4.57
192.168.2.157
192.168.4.54
192.168.2.158
192.168.4.55
192.168.12.116
192.168.12.117
192.168.4.58
192.168.12.118
192.168.4.59
192.168.12.119
192.168.2.151
192.168.12.112
192.168.2.152
192.168.12.113
192.168.12.114
192.168.2.150
192.168.12.115
192.168.2.155
192.168.4.52
192.168.2.156
192.168.4.53
192.168.2.153
192.168.4.50
192.168.12.110
192.168.2.154
192.168.4.51
192.168.12.111
192.168.2.126
192.168.4.45
192.168.12.109
192.168.2.127
192.168.4.46
192.168.2.124
192.168.4.43
192.168.2.125
192.168.4.44
192.168.4.49
192.168.12.105
192.168.12.106
192.168.2.128
192.168.4.47
192.168.12.107
192.168.2.129
192.168.4.48
192.168.12.108
192.168.12.101
192.168.12.102
192.168.12.103
192.168.12.104
192.168.2.122
192.168.4.41
192.168.2.123
192.168.4.42
192.168.2.120
192.168.2.121
192.168.4.40
192.168.12.100
192.168.4.29
192.168.2.137
192.168.4.34
192.168.2.138
192.168.4.35
192.168.2.135
192.168.4.32
192.168.2.136
192.168.4.33
192.168.4.38

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532151
Start date and time:	2024-10-12 16:37:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	R4WCgDAfHB.exe renamed because original name is a hash value
Original Sample Name:	8595a9cecbac3bd363c30c7ab2bec849.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.mine.winEXE@15/8@6/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:39:47	API Interceptor	243x Sleep call for process: NvwmiShell.exe modified
10:41:38	API Interceptor	1067x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ddns.oray.com	SecuriteInfo.com.Trojan.Siggen21.26224.12889.14076.exe	Get hash	malicious	Unknown	Browse	114.215.199.192
	SecuriteInfo.com.Trojan.Siggen21.26224.12889.14076.exe	Get hash	malicious	Unknown	Browse	114.215.199.192
	SecuriteInfo.com.Trojan.Siggen19.8867.11258.22969.exe	Get hash	malicious	Unknown	Browse	114.215.189.130
	SecuriteInfo.com.Trojan.Siggen19.8867.11258.22969.exe	Get hash	malicious	Unknown	Browse	114.215.189.130
	W0ICYWz3Jx.exe	Get hash	malicious	Unknown	Browse	114.215.189.130

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse
	OTm8DpW32j.exe	Get hash	malicious	Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Xmrig	Browse
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	eshkere.bat	Get hash	malicious	Xmrig	Browse
	frik.exe	Get hash	malicious	Xmrig	Browse
	Google Chrome.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

Download File

Process:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	89349120
Entropy (8bit):	5.314244260726842
Encrypted:	false
SSDEEP:	6144:E7Ii4Pqe6UxYX914eN4Us7P3BOcbpUt7V7V0s:lJ6sYkeNE7P3E+C7V7V0
MD5:	34B640C3E7AE045FE1F156B755BB0BE7
SHA1:	AE82A73F4D850D46130CC684B276165EC7EB88EB
SHA-256:	479A6E3AC1006682981031EED2FE87281277A22DCFAA7925A2A18E16333595C0
SHA-512:	B27D08781FF2C00510EF2371B1AD9F988C568DC7764AD6D754BD9F114CFD8A47EBEFFE28B1416BADA35D86C56D237230B58BD71B46D490BA580A2AF7C907CD10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#...p...p...p\|.:p...p..9p..p../p...p.m.p..p...p...p..(p.p..8p...p..=p...pRich...p................PE..L....9Ic................. ...@....................@.......................... ...........................................................9..............................................................H...........................................UPX0....................................UPX1..... ..........................@....rsrc....@.......<... ..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Program Files (x86)\Microsoft Network\Network64.exe

Download File

Process:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	97341952
Entropy (8bit):	5.69859973949719
Encrypted:	false
SSDEEP:	98304:UNVKOOGzixfBKmLyntNUNUUkGxdQQj4FTSVhDALt/W73/ev/ev/egixgixmgRZQR:UPKOOG3duITaFBkkB7Egsp16ziwy0
MD5:	A09B6784FF89670772817524BFE41A76
SHA1:	602A4AAE75FC66A20E40D7EF91B8BA11C22FE6D3
SHA-256:	051D93AE358939785F448AB6BA1E27AC7CAB18B577F5FB03ACF6635C92491E4B
SHA-512:	0551B781CEFD49710D953D64EA6F32480F6745AFA9851BAEE8291A9426BF185785BAF12AD3DBDA2E511D663AA6D9654EC4BE61D25C16D448EEA89A98EC73C7E1
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...I..d........../.......]..B}...............@.............................. ......8.}....... ..............................................`..x@.....@M...@t.x.............................................r.(....................o...............................text.....].......].................`..`.data.........].......].............@.`..rdata..0.....^.......^.............@.p@.pdata..x....@t......<t.............@.0@.xdata.......0w......"w.............@.@@.bss..........z.......................p..idata..x@...`...B....z.............@.0..CRT....p.............{.............@.@..tls..................{.............@.@..rsrc...@M.....@M....{.............@.0.................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys

Download File

Process:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 4%, Browse
Joe Sandbox View:	Filename: GGXhCiYFBw.exe, Detection: malicious, Browse Filename: 7K5DrSyL8Y.exe, Detection: malicious, Browse Filename: egFMhHSlmf.exe, Detection: malicious, Browse Filename: OTm8DpW32j.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: 0NSjUT34gS.exe, Detection: malicious, Browse Filename: eshkere.bat, Detection: malicious, Browse Filename: frik.exe, Detection: malicious, Browse Filename: Google Chrome.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\checkip[1].htm

Download File

Process:	C:\Program Files (x86)\Microsoft Network\HelpSystem.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	4.147114052043201
Encrypted:	false
SSDEEP:	3:ORy0WtJBUXMRn:+PoJiXG
MD5:	41F4D2DFE0923257C7A383D0C6204E53
SHA1:	9D5BD434E4E50BEF880C9D6BCD6C2F3B76FE72F1
SHA-256:	6681FAC5BD32E8F0378F0AB3C6B969AC38E91551719DE51553BB7AF089418AA0
SHA-512:	BFF78E6E4F240591F041C57979D8BE00485EFE1FB4B0F22546575E218BBF27B18C36C1605B4D1FC9C351287CBDC8790F378FD2D7D2CCB81AEB1B9B2CD06F2D5E
Malicious:	true
Reputation:	low
Preview:	Current IP Address: 8.46.123.33

C:\Windows\SystemNvwmiShell\NvwmiShell.dll

Download File

Process:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
File Type:	data
Category:	dropped
Size (bytes):	8629952
Entropy (8bit):	7.999981027200894
Encrypted:	true
SSDEEP:	196608:wCQLJWjMlhDB3dRvBbYiqZBkBQBzTciO1nfniCrmNKYO:wC9YlhDBtezkOBki2nvlrmNKv
MD5:	6E5E20345297246C9E8A18D9B203F47E
SHA1:	1177FA6B654D8B09A1CB8DFD78ADE2A280F9E716
SHA-256:	A18B00D4720F0BE03A1A87332EEA1C29021DF27F42FC497710C3CC3E82D7212B
SHA-512:	08786A7A5B2B3A6E47FCE09B3E8D66E6501B0BB3D01BF7DB887CBCCC1D5B09BEDE93AD42AAF834494280A212BB33432E560694F3A8FBDE02D9274EDCC159A0AA
Malicious:	false
Preview:	.x.&7.......C..\|T..-2K..{B....!M.ot..X..U..\.(<..{'.6~..dF.P.`.,T0.K...K.Z%[...+......S."..[.2..G....Ze....0.p.w.l......a.~./...H..A.\..?..Ein...+..MN.S?x'{f.... .r.Y.Fl..ym....![.b}Q{..>`..:...D..ZT..e(.(.)%.-....]I....k4.)....(.r...c.J^.S........).m.#ix...[.LX.\|.g...x.A.E.fZ.....F..4..2kid..[be.........D.vBn.qE{2.\|w.....ab...>.....h.0'.~...;.\|x....3..h..1..;3.6 .<....5GH.f..s.........?....:.~..L."V..XRE.].b..@/........P.f..H.. ...6....5....sA.S..H.K.......&...../w..r......H.y.....nE.fw.].U..Z"%...T`.. ..p.......!_XrA.+f.E./...4...R....4.6..\|$.b.!Q..&).+...x..Htv....c.L.>7(.>.vLK.nWx..4..L;.S....qv..i..2......`.....zZOE....-.t.B.I.. ..\C...H..^@s...-.X..-s.$.;...A..(.`x.W-..<....d.fc.....1._C........pB..AJ.WG.5z\|....R..S.Q......J...z...(.$.....2..........%..e......n........Q..U......7..q.....I2G....ZL..=...V...C.....n.O<.$..+..p.a..q....t..........m"]M.tB.J...dq....c1$tes.$....h.Na@.S.k...iy.n&`..1...Npx...eD...m...\|....wH.......`:

C:\Windows\SystemNvwmiShell\NvwmiShell.exe

Download File

Process:	C:\Users\user\Desktop\R4WCgDAfHB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79073664
Entropy (8bit):	5.670612439091091
Encrypted:	false
SSDEEP:	6144:098TSnLDuZvOx31RZG15VoZppGJyCNDri5sfJXn+oAyu:nZvO7RQaZOJyEDj0Lyu
MD5:	8F0FE69596C6D95FEFADF00B3E28707D
SHA1:	3BBBFC2058995D3F77CF1AE043C810D656BFE406
SHA-256:	4E44955C7BA4F77AC2D29D054D3E4D8838FA795B8495FDF7747B9020CB208E21
SHA-512:	3AC74B5ACE3CD983ED23795D9E98C44B8BD8B6844702CF99B23972B3E78CB5C6B342970C31A5472D26C90E4C90208AD7C508AD9E2F461BE25ECB1704B2893A0D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>.E.PSE.PSE.PS...SD.PSbk=SB.PSbk+SP.PSE.QS..PS[..S_.PS[..S.PS[..S.PS[..SF.PS[..SD.PS[..SD.PSRichE.PS........................PE..L...N..e.....................P....................@..................................^....@.................................l^...........u...........<...5...@.......................................8..@....................]..@....................text............................... ..`.rdata...r.......t..................@..@.data....2...........`..............@....rsrc....u.......v...X..............@..@.reloc..Nm...@...n..................@..B........................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files (x86)\Microsoft Network\HelpSystem.exe
File Type:	ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	59823
Entropy (8bit):	3.5127837084076443
Encrypted:	false
SSDEEP:
MD5:	5781F51DF1EF81EA977E7D97F761A481
SHA1:	E0E9987252893EFE891EF68D35414A4626B0A4CB
SHA-256:	BC88623A0330A313BBF880A952C4A97AE4F56856FBA6603AFAB05D8A9393B6DC
SHA-512:	86DF35CAB1EC5F44D08E791E3938BF3D95543716253684F8CAD09D3ED4D930B3EAD58430637AA36CE52CC2C4874553523026A55F2B2F66765913DE745D6BA586
Malicious:	false
Preview:	-> 1/65535 - 0.-> 2/65535 - 0.-> 3/65535 - 0.-> 4/65535 - 0.-> 5/65535 - 0.-> 6/65535 - 0.-> 7/65535 - 0.-> 8/65535 - 0.-> 9/65535 - 0.-> 10/65535 - 0.-> 11/65535 - 0.-> 12/65535 - 0.-> 13/65535 - 0.-> 14/65535 - 0.-> 15/65535 - 0.-> 16/65535 - 0.-> 17/65535 - 0.-> 18/65535 - 0.-> 19/65535 - 0.-> 20/65535 - 0.-> 21/65535 - 0.-> 22/65535 - 0.-> 23/65535 - 0.-> 24/65535 - 0.-> 25/65535 - 0.-> 26/65535 - 0.-> 27/65535 - 0.-> 28/65535 - 0.-> 29/65535 - 0.-> 30/65535 - 0.-> 31/65535 - 0.-> 32/65535 - 0.-> 33/65535 - 0.-> 34/65535 - 0.-> 35/65535 - 0.-> 36/65535 - 0.-> 37/65535 - 0.-> 38/65535 - 0.-> 39/65535 - 0.-> 40/65535 - 0.-> 41/65535 - 0.-> 42/65535 - 0.-> 43/65535 - 0.-> 44/65535 - 0.-> 45/65535 - 0.-> 46/65535 - 0.-> 47/65535 - 0.-> 48/65535 - 0.-> 49/65535 - 0.-> 50/65535 - 0.-> 51/65535 - 0.-> 52/65535 - 0.-> 53/65535 - 0.-> 54/65535 - 0.-> 55/65535 - 0.-> 56/65535 - 0.-> 57/65535 - 0.-> 58/65535 - 0.-> 59/65535 - 0.-> 60/65535 - 0.-> 61/65535 - 0.-> 62/65535 - 0.-> 63/65535 - 0.-

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.761976958626553
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	R4WCgDAfHB.exe
File size:	422'352 bytes
MD5:	8595a9cecbac3bd363c30c7ab2bec849
SHA1:	5a154a7472cc4afa18f414a3edf8f3ff7a2a51e2
SHA256:	df2b80bb68e829de13051a9781e096b095a90b676ab1f974284bad8609775040
SHA512:	2d2d34ce590af7bb1902a5b355452efa9b9c6f947e7c288d7d575b0aa117a2870e99ddf11f4c9c4b936a889852726fd28f99973a5559e34b86af2940198eacec
SSDEEP:	6144:098TSnLDuZvOx31RZG15VoZppGJyCNDri5sfJXn+oAy:nZvO7RQaZOJyEDj0Ly
TLSH:	4D944C10295F8C3BD883B5394AA1CFAB95F66C204E2746677AE13E2D7FF624365102C7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>.E.PSE.PSE.PS...SD.PSbk=SB.PSbk+SP.PSE.QS..PS[..S_.PS[..S..PS[..S..PS[..SF.PS[..SD.PS[..SD.PSRichE.PS.......................

File Icon


Icon Hash:	8ca2c096b0c1e245

Static PE Info

General

Entrypoint:	0x40ec06
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C4D54E [Thu Feb 8 13:21:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	97843ffb69d38c7f82140e8b5fff11a2

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	05/01/2016 19:00:00 28/03/2019 19:59:59
Subject Chain	CN=Qihoo 360 Software (Beijing) Company Limited, OU=Tech. Dev. Dept., O=Qihoo 360 Software (Beijing) Company Limited, L=Beijing, S=Beijing, C=CN
Version:	3
Thumbprint MD5:	458049CD38BF196FA31298973E90FBE2
Thumbprint SHA-1:	D4FB2982268B592E3CD46FA78194E71418297741
Thumbprint SHA-256:	0C9E4AE0B30089F2608168012D7D453CE982CCACC709D566C0ADD9DAB14C7E15
Serial:	26279F0F2F11970DCCF63EBA88F2D4C4

Entrypoint Preview

Instruction
call 00007FD2D46F6B1Fh
jmp 00007FD2D46F103Dh
push 0000000Ch
push 004258D8h
call 00007FD2D46F3869h
and dword ptr [ebp-1Ch], 00000000h
mov esi, dword ptr [ebp+08h]
cmp esi, dword ptr [0043B1E8h]
jnbe 00007FD2D46F11E4h
push 00000004h
call 00007FD2D46F479Bh
pop ecx
and dword ptr [ebp-04h], 00000000h
push esi
call 00007FD2D46F4FD2h
pop ecx
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FD2D46F11CEh
mov eax, dword ptr [ebp-1Ch]
call 00007FD2D46F3875h
ret
push 00000004h
call 00007FD2D46F4696h
pop ecx
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword ptr [ebp+08h]
cmp esi, FFFFFFE0h
ja 00007FD2D46F1267h
push ebx
push edi
mov edi, dword ptr [0042020Ch]
cmp dword ptr [004399D0h], 00000000h
jne 00007FD2D46F11DAh
call 00007FD2D46F61A1h
push 0000001Eh
call 00007FD2D46F5FEFh
push 000000FFh
call 00007FD2D46F17CAh
pop ecx
pop ecx
mov eax, dword ptr [0043B1F8h]
cmp eax, 01h
jne 00007FD2D46F11D0h
test esi, esi
je 00007FD2D46F11C6h
mov eax, esi
jmp 00007FD2D46F11C5h
xor eax, eax
inc eax
push eax
jmp 00007FD2D46F11DEh
cmp eax, 03h
jne 00007FD2D46F11CDh
push esi
call 00007FD2D46F1118h
pop ecx
test eax, eax
jne 00007FD2D46F11D8h
test esi, esi
jne 00007FD2D46F11C3h
inc esi
add esi, 0Fh
and esi, FFFFFFF0h

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25e6c	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x27514	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x63c00	0x35d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x64000	0x1fe4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x238f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x3c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x25de4	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1e68b	0x1e800	445bb6b54111debd9c1f3b5f74fbc7cd	False	0.5619236680327869	data	6.59725871904921	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0x7296	0x7400	4a52feb77c8902486928bfc47d62c9f4	False	0.3529768318965517	data	5.03423408860561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x13214	0xf800	e843d6280cb8648fbd7d68f6eedd5f49	False	0.9019814768145161	data	7.703478425686808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c000	0x27514	0x27600	40a4916702e3059f7f9de551807c97a4	False	0.3399925595238095	data	6.374114056365639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x64000	0x6d4e	0x6e00	0ab9a2f00dd2bb6b3579589e136170da	False	0.2256036931818182	data	2.7096104954987683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x3cda8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x3cedc	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x3cf90	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x3d0c4	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x3d1f8	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x3d32c	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x3d460	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x3d594	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x3d6c8	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x3d7fc	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x3d930	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x3da64	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x3db98	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x3dccc	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x3de00	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x3df34	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x3e068	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x3e120	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x3e264	0x2868	Device independent bitmap graphic, 128 x 256 x 4, image size 0	Chinese	China	0.4840487238979118
RT_ICON	0x40acc	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	Chinese	China	0.5201219512195122
RT_ICON	0x41134	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	Chinese	China	0.5994623655913979
RT_ICON	0x4141c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	Chinese	China	0.6147540983606558
RT_ICON	0x41604	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	Chinese	China	0.5912162162162162
RT_ICON	0x4172c	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 0, 256 important colors	Chinese	China	0.2611304883052934
RT_ICON	0x46354	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0, 256 important colors	Chinese	China	0.4736140724946695
RT_ICON	0x471fc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0, 256 important colors	Chinese	China	0.4553249097472924
RT_ICON	0x47aa4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0, 256 important colors	Chinese	China	0.4141705069124424
RT_ICON	0x4816c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0, 256 important colors	Chinese	China	0.26083815028901736
RT_ICON	0x486d4	0x5006	PNG image data, 256 x 0, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9965342184906766
RT_ICON	0x4d6dc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	Chinese	China	0.13229031113214243
RT_ICON	0x5df04	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Chinese	China	0.233298755186722
RT_ICON	0x604ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Chinese	China	0.3079268292682927
RT_ICON	0x61554	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Chinese	China	0.375
RT_ICON	0x61edc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.3448581560283688
RT_DIALOG	0x62344	0xdc	data	Chinese	China	0.7272727272727273
RT_DIALOG	0x62420	0xe2	data	Chinese	China	0.6814159292035398
RT_DIALOG	0x62504	0x34	data	Chinese	China	0.9038461538461539
RT_STRING	0x62538	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x62588	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x625b4	0x82	data	Chinese	China	0.9307692307692308
RT_STRING	0x62638	0x1d6	data	Chinese	China	0.8148936170212766
RT_STRING	0x62810	0x160	data	Chinese	China	0.4971590909090909
RT_STRING	0x62970	0x12e	data	Chinese	China	0.652317880794702
RT_STRING	0x62aa0	0x50	data	Chinese	China	0.7125
RT_STRING	0x62af0	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x62b34	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x62b9c	0x1b8	data	Chinese	China	0.6568181818181819
RT_STRING	0x62d54	0x104	data	Chinese	China	0.6038461538461538
RT_STRING	0x62e58	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x62e7c	0x30	data	Chinese	China	0.625
RT_GROUP_CURSOR	0x62eac	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x62ed0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62ee4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62ef8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f0c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f20	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f34	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f48	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f5c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f70	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f84	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62f98	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62fac	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62fc0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x62fd4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_ICON	0x62fe8	0xe6	data	Chinese	China	0.6
RT_VERSION	0x630d0	0x2e8	data	Chinese	China	0.4596774193548387
RT_MANIFEST	0x633b8	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	HeapReAlloc, GetCommandLineA, GetStartupInfoA, RtlUnwind, Sleep, ExitProcess, RaiseException, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetACP, IsValidCodePage, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetOEMCP, GetCPInfo, GetModuleHandleW, SetErrorMode, CreateFileA, GetCurrentProcess, FlushFileBuffers, SetFilePointer, WriteFile, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, GetVersionExA, InterlockedIncrement, FormatMessageA, MultiByteToWideChar, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalFree, LocalAlloc, GlobalFlags, GlobalFree, GlobalUnlock, InterlockedDecrement, GetModuleFileNameW, WritePrivateProfileStringA, GetCurrentProcessId, GetLastError, SetLastError, GlobalAddAtomA, CloseHandle, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, EnumResourceLanguagesA, GetModuleFileNameA, GetLocaleInfoA, WideCharToMultiByte, CompareStringA, FindResourceA, LoadResource, LockResource, SizeofResource, InterlockedExchange, GlobalLock, lstrcmpA, GlobalAlloc, GetModuleHandleA, lstrlenA, HeapFree, FreeLibrary, GetProcessHeap, HeapAlloc, GetProcAddress, LoadLibraryA, IsBadReadPtr, VirtualProtect, VirtualFree, GetEnvironmentStringsW, VirtualAlloc
USER32.dll	GetSysColorBrush, ShowWindow, RegisterWindowMessageA, LoadIconA, WinHelpA, GetClassLongA, SetPropA, GetPropA, RemovePropA, IsWindow, GetForegroundWindow, GetDlgItem, GetTopWindow, DestroyWindow, GetMessageTime, GetMessagePos, MapWindowPoints, SetMenu, SetForegroundWindow, GetClientRect, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, AdjustWindowRectEx, CopyRect, DefWindowProcA, CallWindowProcA, GetMenu, SetWindowLongA, SetWindowPos, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetSystemMetrics, GetMenuItemID, GetSubMenu, GetWindow, GetDlgCtrlID, GetWindowRect, GetClassNameA, PtInRect, GetWindowTextA, SetWindowTextA, GetSysColor, PostMessageA, PostQuitMessage, CheckMenuItem, EnableMenuItem, ReleaseDC, GetDC, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, UnhookWindowsHookEx, GetMenuItemCount, UnregisterClassA, DestroyMenu, GetMenuState, ModifyMenuA, SendMessageA, GetParent, GetFocus, LoadBitmapA, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, ValidateRect, GetCursorPos, PeekMessageA, GetKeyState, IsWindowVisible, GetActiveWindow, DispatchMessageA, TranslateMessage, GetMessageA, CallNextHookEx, SetWindowsHookExA, SetCursor, LoadCursorA, GetCapture, ClientToScreen, GetWindowThreadProcessId, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, EnableWindow, MessageBoxA
GDI32.dll	DeleteDC, GetStockObject, GetDeviceCaps, SelectObject, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, CreateBitmap, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, DeleteObject, GetClipBox, SetMapMode, SetTextColor, SetBkColor, RestoreDC, SaveDC, SetViewportOrgEx
WINSPOOL.DRV	DocumentPropertiesA, OpenPrinterA, ClosePrinter
ADVAPI32.dll	RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegOpenKeyA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey
SHLWAPI.dll	PathFindFileNameA, PathFindExtensionA
OLEAUT32.dll	VariantClear, VariantChangeType, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-12T16:39:54.910290+0200	2830483	ETPRO MALWARE Observed Malicious User-Agent (WinInetGet/)	1	192.168.2.4	50024	114.215.199.192	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 16:38:08.875833988 CEST	49746	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:08.881103992 CEST	8686	49746	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:08.881185055 CEST	49746	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:08.881231070 CEST	49746	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:08.886507988 CEST	8686	49746	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:09.579433918 CEST	8686	49746	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:09.579987049 CEST	49746	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:09.585849047 CEST	8686	49746	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:09.586091995 CEST	49746	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:09.591177940 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:09.596647978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:09.596926928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:09.596926928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:09.602313042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.460414886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.460479021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.460623980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.574153900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.574201107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.574237108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.574273109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.574385881 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.574595928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.579330921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.628726959 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.705590963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.705647945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.705667973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.705686092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.705701113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.705719948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.706037045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.706037045 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.706073046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.706289053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.819340944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819433928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819473028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819500923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.819505930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819540024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819552898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.819572926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819607019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819622993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.819648027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.819706917 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.820152044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.862807035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.932996988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933042049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933062077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933079004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933094978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933151960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933362007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:10.933614016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933675051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933717012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933751106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:10.933861971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.046564102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046633959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046673059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046705008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046740055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046772957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046772003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.046772003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.046806097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046838999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046844006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.046875000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.046905994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.097302914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.161587000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161658049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161694050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161725998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161758900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161789894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161789894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.161791086 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.161825895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.161859989 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.162061930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.162096977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.162224054 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.206681013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.274913073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.274982929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275017023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275051117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275068045 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.275088072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275120974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.275122881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275165081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275192022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.275891066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275940895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.275945902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.316055059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.388859034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.388910055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.388947964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.388981104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.388983011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.389014959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.389045954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.389050007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.389086962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.389116049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.389766932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.389820099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.389836073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.440972090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.502852917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.502901077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.502955914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.502989054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.503025055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.503057003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.503092051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.503093004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.503093004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.503128052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.503161907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.503182888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.503767967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.550425053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.616117001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616166115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616202116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616216898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.616239071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616290092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.616411924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616446972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616481066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616489887 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.616514921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.616556883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.617129087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.659702063 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.729986906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730036020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730093002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730125904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730149984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.730160952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730194092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730218887 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.730227947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730237007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.730262041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730299950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.730308056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.784694910 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.843692064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.843743086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.843776941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.843813896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.843859911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.843861103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.844197989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.844254971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.844290972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.844326973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.844369888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.844369888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.844856024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.894201994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.957469940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957540989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957576036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957608938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957645893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957657099 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.957678080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957712889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957727909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.957727909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.957746983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:11.957797050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:11.958393097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.003438950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.071013927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071063042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071099043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071132898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071238041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.071238041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.071376085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071445942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071479082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071533918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.071679115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.071679115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.072071075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.112941027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.184504032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.184547901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.184582949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.184617996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.184653044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.184689999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.184685946 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.184685946 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.184777975 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.185420990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.185470104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.185508966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.185538054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.185556889 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.185647964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.298842907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.298893929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.298929930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.298962116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.298995972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.299026966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.299040079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.299040079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.299062967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.299159050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.299278975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.299314022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.299355030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.347217083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.412012100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412036896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412055969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412070036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412087917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412105083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412121058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412137985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.412190914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.412190914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.412190914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.412192106 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.412971020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.456717968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.525799990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526220083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526242971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526259899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526276112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526292086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526307106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526324034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526392937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.526392937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.526392937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.526392937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.526823997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526844978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.526981115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.639415026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639441013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639457941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639473915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639492035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639611959 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.639847040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639874935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639892101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.639909029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.640034914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.640034914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.691065073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.762831926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.762855053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.762871981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763014078 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.763099909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763128042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763160944 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.763897896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763914108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763930082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763945103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.763953924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.763979912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.816102982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.874689102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.874737978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.874773979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.874805927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.874860048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.874886990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.874886990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.875071049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.875104904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.875251055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.875253916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.875291109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.875324011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.925353050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.988441944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988488913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988523960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988554955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988588095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988615990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.988616943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.988651037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988701105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988733053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988734961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:12.988765001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:12.988776922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.034719944 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.102185965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102236986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102273941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102307081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102343082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102359056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.102359056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.102375031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102408886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102432966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.102442026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102478027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.102509975 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.144207001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.215424061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215500116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215533972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215564966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215599060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215627909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215662003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215689898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.215744019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.215744019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.215879917 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.216212034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.269308090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.328718901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.328748941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.328771114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.328789949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.328810930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.328893900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.328893900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.328924894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.328979015 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.329005003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.329219103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.329279900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.329391003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.378621101 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.442964077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443039894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443079948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443114996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443135023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.443150997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443183899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443201065 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.443221092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443243980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.443257093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443294048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.443320036 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.487893105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.555962086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556082964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556118965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556154013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556164026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.556195021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556236029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.556663990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556688070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556705952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556720972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.556724072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.556752920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.597234011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.669759035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.669785023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.669801950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.669816971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.669836044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.669841051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.669922113 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.670120001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.670176983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.670197010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.670212984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.670245886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.670296907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.722362041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.783588886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783638954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783675909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783709049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783759117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783788919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.783790112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.783813953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783852100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.783869982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.784055948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.784090996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.784210920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.831588030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.896891117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.896944046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.896980047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897011995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897068024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897078037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.897078037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.897103071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897136927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897152901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.897171021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897207975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:13.897217035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:13.941113949 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.010540962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.010592937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.010631084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.010664940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.010703087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.010757923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.010757923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.011019945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.011053085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.011086941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.011120081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.011192083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.011193037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.066091061 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.125988007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126060009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126097918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126132011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126166105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126198053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126199961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.126200914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.126235008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126380920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126415968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.126559973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.126559973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.175451994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.239564896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239619017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239659071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239712954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239743948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.239748001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239783049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239814043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.239816904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239842892 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.239850998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239886999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.239900112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.284811974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.352845907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.352869987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.352885962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.352901936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.353004932 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.353099108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.353308916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.353329897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.353346109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.353359938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.353375912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.353463888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.353463888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.394287109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.466669083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466730118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466768980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466801882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466837883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466871977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466906071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466911077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.466942072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.466983080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.467014074 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.467690945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.519232988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.580105066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580153942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580195904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580229998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580265045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580318928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580354929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580387115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580424070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.580444098 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.580444098 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.580492973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.628757954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.707568884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.707618952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.707654953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.707688093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.707724094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.707752943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.707752943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.707905054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.707940102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.708112955 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.708195925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.708234072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.708256960 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.753637075 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.821666956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.821719885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.821738958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.821754932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.821774006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.822195053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.822252989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.822252035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.822273016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.822293043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.822612047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.934672117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.934762001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.934781075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.934799910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.934900045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.934954882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.934987068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.935020924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.935053110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:14.935103893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.935103893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.935103893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:14.987960100 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.048290014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048360109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048396111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048428059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048463106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048494101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048516035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.048516989 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.048530102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.048604965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.049313068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.049370050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.049397945 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.097248077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.162306070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162358046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162395954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162429094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162466049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162482977 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.162482977 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.162503004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162533998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162552118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.162569046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162600994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.162620068 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.206717968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.275871992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.275922060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.275958061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.275990963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.276026964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.276052952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.276052952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.276149988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.276185036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.276211023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.276217937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.276249886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.276279926 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.331595898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.389518976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389574051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389594078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389626026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389643908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389658928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389698982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389731884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389767885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.389779091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.389780045 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.389858007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.440984011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.503199100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503268003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503304005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503336906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503370047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503432035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503464937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.503470898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503504038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503521919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.503540039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.503578901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.550462961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.617043018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617094040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617130041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617162943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617167950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.617202044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617223978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.617305994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617340088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617362022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.617373943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617405891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.617427111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.659857035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.731038094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731084108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731105089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731138945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731170893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731214046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731246948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731281042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.731319904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.731321096 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.731431961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.732075930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.784847021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.843652964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843708038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843760014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843815088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843821049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.843848944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843880892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843890905 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.843914032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.843945026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.844767094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.844800949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.844831944 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.844835043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.844907045 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.957423925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.957596064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.957612038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.957628012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.957643032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.957655907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.957731009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.957871914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.957931042 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.957946062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.958152056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:15.958199024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:15.958200932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.003613949 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.071212053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071235895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071253061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071389914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.071413994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071444035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071460962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071469069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071485996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.071491003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.071513891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.071564913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.072247982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.112987041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.185142040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185187101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185224056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185259104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185292006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185326099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185329914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.185363054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185394049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.185394049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.185884953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185919046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.185952902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.186070919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.298988104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299036980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299073935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299108028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299113035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.299143076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299173117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.299180984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299216986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299226999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.299490929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299545050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.299549103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.347330093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.412211895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412249088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412282944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412316084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412350893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412405968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.412405968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.412622929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412677050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412708044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.412709951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412744045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.412782907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.456583023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.536216021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536241055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536257982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536273956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536288977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536309004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536328077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.536422968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.536422968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.537123919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.537138939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.537153959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.537317991 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.537317991 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.649719000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.649772882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.649830103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.649838924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.649864912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.649909973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.649921894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.649956942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.649991989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.650003910 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.650026083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.650062084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.650068998 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.691083908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.763652086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763732910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763770103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763802052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763838053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763895035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763928890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763928890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.763928890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.763962984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.763999939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.764015913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.764017105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.815965891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.877120018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877192974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877228022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877262115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877295971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877329111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877361059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877396107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.877666950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.877666950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.877918005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.925358057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.990916967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.990968943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991005898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991038084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991091013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991102934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.991102934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.991147041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991182089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991214991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991216898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:16.991250038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:16.991281986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.034849882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.104367018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104415894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104461908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104487896 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.104527950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104562044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104582071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.104593992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104628086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104639053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.104661942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104696989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.104707003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.159843922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.217852116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.217873096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.217907906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.217922926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.217927933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.217940092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.217953920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.217962980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.217995882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.218663931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.218677998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.218693018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.218708038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.219261885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.219261885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.331897974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.331954002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332010984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332043886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332077026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332109928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332122087 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.332144976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332186937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.332236052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.332236052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.332263947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.378516912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.445628881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445679903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445713997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445745945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445744991 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.445780993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445810080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.445920944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445954084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.445981979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.445990086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.446023941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.446053028 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.485805035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.559350014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559428930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559465885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559503078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559536934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559539080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.559572935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559578896 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.559608936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.559636116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.560229063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.560277939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.560316086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.560398102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.560398102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.672590017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672614098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672631979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672646046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672662973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672688007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.672763109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.672841072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672874928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672899961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.672909975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672941923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.672955990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.722330093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.786400080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786452055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786492109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786524057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786572933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.786583900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786617041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786645889 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.786667109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.786688089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786721945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786756992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.786770105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.829824924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.899858952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.899909973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.899945021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.899976969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900010109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900031090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.900032043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.900042057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900075912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900110960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900119066 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.900161028 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:17.900517941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900557995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:17.900682926 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.013695002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013751030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013787985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013820887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013837099 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.013854980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013886929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013921022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.013921022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.013945103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.013957024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.014002085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.014595032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.014650106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.014700890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.127121925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127159119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127183914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127198935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127213955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127229929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127249002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127270937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.127296925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.127363920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.128149986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.175398111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.240854025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.240927935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.240963936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.240995884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.241007090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.241029978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.241060972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.241092920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.241116047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.241116047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.241128922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.241175890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.241767883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.284847975 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.354584932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354630947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354669094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354703903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354737043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354758978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.354772091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354758978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.354826927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.354876995 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.355583906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.355633974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.355639935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.355675936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.355726004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.468276978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468324900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468362093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468395948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468394995 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.468432903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468472958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468483925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.468511105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.468570948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.469090939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.469142914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.469182968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.469212055 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.469244003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.581636906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.581670046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.581692934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.581712961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.581737041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.581800938 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.581800938 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.581964970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.581986904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.582007885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.582029104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.582155943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.582155943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.628499031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.696686029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696759939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696795940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696829081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696865082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696870089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.696871042 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.696897984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696933031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.696962118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.696965933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.697002888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.697010994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.738071918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.822365046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822417021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822475910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822510958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822547913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822582960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822598934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.822599888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.822618008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822655916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822690010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.822695017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.822765112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.936052084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936105013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936140060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936172962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936206102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936239004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936270952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936278105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.936278105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.936305046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.936358929 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.936358929 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:18.937093019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:18.987900019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.049457073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049504042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049560070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049593925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049596071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.049628019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049665928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.049684048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049720049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.049772024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.050462008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.050496101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.050510883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.050534010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.050880909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.164022923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164073944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164109945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164143085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164141893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.164179087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164222002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.164290905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164324045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164357901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164371014 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.164391994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.164437056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.290287018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290337086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290373087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290405035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290429115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.290438890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290472031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290504932 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.290507078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290539026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290549994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.290574074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.290600061 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.331614971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.413294077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413316965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413331985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413338900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413357019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413404942 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.413405895 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.413455009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413471937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413487911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413503885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.413518906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.413537025 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.456696033 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.504213095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504235983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504251957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504268885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504286051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504302025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504400015 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.504400969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.504400969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.504904032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504920959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504937887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.504956007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.505057096 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.505057096 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.617659092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.617686033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.617702961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.617717028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.617733002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.617805004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.618052006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.618078947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.618093014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.618108988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.618182898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.618182898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.731161118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731230974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731266975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731304884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731338978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731352091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.731352091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.731373072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731441975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.731493950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.732280016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.732335091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.732445955 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.784797907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.845035076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845083952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845120907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845153093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845185995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845217943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845231056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.845232010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.845253944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.845304012 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.846139908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.846191883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.846324921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.894233942 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.958439112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958482027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958538055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958573103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958605051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958605051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.958662987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958667994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.958702087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.958749056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.959577084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.959624052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.959665060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:19.959738016 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:19.959738970 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.072432041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.072478056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.072514057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.072547913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.072582006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.072587013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.072617054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.072618961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.072654009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.072654009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.073575020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.073622942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.073663950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.073771954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.073856115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.185630083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.185672045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.185708046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.185786963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.186048985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.186109066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.186156988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.186157942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.186192989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.186224937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.186239004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.186264992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.186789036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.237826109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.302597046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302649021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302683115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302716970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302750111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302747965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.302783012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302809000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.302819014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302851915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302867889 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.302886009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.302898884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.347246885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.413388014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413439989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413475990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413530111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413568020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413603067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413614988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.413614988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.413639069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413671970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413692951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.413710117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.413755894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.526741028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.526765108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.526782036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.526797056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.526813030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.526942968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.526942968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.527180910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.527209997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.527230978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.527374029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.527420998 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.527442932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.581563950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.640346050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640388012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640420914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640450954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.640455008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640489101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640497923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.640818119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640851974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640883923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.640887022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640919924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.640933990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.690965891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.754035950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754120111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754154921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754189014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754209995 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.754225016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754247904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.754357100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754400969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.754481077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754513979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754570007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754599094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.754616976 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.754645109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.868112087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868160009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868195057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868227959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868257999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.868263006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868324995 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.868441105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868474960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868493080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.868510008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868546009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.868572950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.909724951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.981936932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.981987953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982023001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982055902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982079029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.982120037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.982120991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982177019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982211113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982225895 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:20.982245922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982281923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:20.982301950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.034723997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.095251083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095273972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095289946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095422029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095434904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.095439911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095467091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095480919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095499039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.095506907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.095527887 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.095566988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.096380949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.144081116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.209067106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209090948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209108114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209125042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209156990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.209212065 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.209377050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209404945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209422112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209460974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.209937096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209985971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.209996939 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.210022926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.210078001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.322828054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.322851896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.322869062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.322885036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.322901964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.322921991 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.322974920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.323071957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.323118925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.323136091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.323152065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.323168039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.323203087 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.378470898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.436223030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436245918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436263084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436278105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436295986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436305046 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.436366081 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.436512947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436530113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436547995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436562061 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.436570883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.436606884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.487832069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.550040960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550066948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550084114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550100088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550116062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550132036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550146103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550219059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.550219059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.550770044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550791025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550806999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.550827026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.550863981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.551105976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.597223043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.663784981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.663836002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.663872004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.663904905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.663928032 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.663939953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.663966894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.664000034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.664045095 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.664191008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.664225101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.664258003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.664272070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.706600904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.778378010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.778399944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.778418064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.778434038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.778453112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.778656006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.778948069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.779005051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.779042006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.779067039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.779077053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.779098034 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.831708908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.890927076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.890952110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.890970945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.890989065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.891022921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.891052008 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.891486883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.891535044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.891571045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.891593933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:21.891603947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.891654015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:21.891700983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.004710913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004756927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004793882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004827976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004862070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004874945 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.004897118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004933119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.004940987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.004995108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.005700111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.005750895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.005765915 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.005790949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.006210089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.118432999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118504047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118537903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118571043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118587971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.118604898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118639946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118668079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.118673086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.118693113 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.118706942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.119203091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.119239092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.119259119 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.119277000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.231992006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232063055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232099056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232131004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232160091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.232167006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232197046 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.232254982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232310057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232342958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232377052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.232409000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.232409000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.284849882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.354254961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354279041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354296923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354312897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354331017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354341030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.354415894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.354624033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354646921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354665995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354681969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.354697943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.354724884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.474963903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.475050926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.475086927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.475105047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.477005959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.477066040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.477164984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.477197886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.477241039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.477721930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.477926016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.477960110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.477993011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.478001118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.478041887 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.589117050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589184999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589220047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589252949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589286089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589318037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589329004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.589351892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589386940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.589391947 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.589437962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.590096951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.644112110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.702510118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.702534914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.702550888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.702564955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.702580929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.702595949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.702641964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.702641964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.702641964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.703068972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.703113079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.703147888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.703182936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.703255892 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.703255892 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.816019058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816042900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816060066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816075087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816093922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816131115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.816184998 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.816431046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816503048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816520929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.816586018 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.816586971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.816627026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.862863064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.929857016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.929928064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.929964066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.929997921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.930015087 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.930032015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.930085897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.930119038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.930119991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.930151939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.930187941 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.930191040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:22.930231094 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:22.972346067 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.044368982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044389963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044405937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044420958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044440031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044480085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.044763088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044779062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044795036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044811010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.044814110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.044843912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.097330093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.157077074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157124996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157160997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157186031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.157195091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157232046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157249928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.157469034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157505035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157522917 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.157711029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157763958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.157764912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.206634998 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.271025896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271075964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271111012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271143913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271179914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271186113 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.271215916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271220922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.271287918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.271344900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271466970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271502018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.271528959 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.316128969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.384845972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.384913921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.384933949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.384949923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.384968042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.384989023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.385024071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.385040045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.385062933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.385257959 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.425338984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.498184919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498255968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498291969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498323917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498332024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.498358965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498393059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498394012 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.498429060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498440027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.498465061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.498513937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.498554945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.550477982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.611720085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611763954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611805916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611840010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611843109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.611856937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611891031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611898899 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.611911058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.611960888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.612870932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.612929106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.612967968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.612973928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.613023043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.725683928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725759983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725795031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725828886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725876093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.725891113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725925922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725939989 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.725960016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.725979090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.725999117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.726069927 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.726185083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.726377010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.726435900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.839112997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839133024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839143038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839205980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839231014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839246035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839260101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839277029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.839276075 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.839330912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.842025995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.894099951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.952985048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953008890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953026056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953151941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953171015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953187943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953217030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953238964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.953274965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.953761101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953778028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953793049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:23.953835964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:23.953890085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.066632986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.066685915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.066720963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.066756964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.066798925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.066842079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.067126989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.067176104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.067212105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.067244053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.067280054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.067311049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.067311049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.112889051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.180289030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180313110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180330038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180346966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180445910 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.180455923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180480957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.180489063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180506945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180533886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180535078 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.180551052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.180588961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.294102907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294152021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294188023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294219971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294253111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.294259071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294300079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.294312000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294348955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294361115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.294661999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294698000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.294719934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.347243071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.407622099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407658100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407691956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407723904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407732010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.407757044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407794952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.407797098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407831907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.407845974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.408579111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.408612967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.408647060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.408648014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.408708096 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.521744013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521794081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521830082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521862984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521897078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521928072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521950960 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.521951914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.521960974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.521996021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.522027969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.522048950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.522613049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.569801092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.635029078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635075092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635130882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635165930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635195017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.635199070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635226965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.635232925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635271072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.635286093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.636143923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.636193037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.636217117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.636230946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.636282921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.749006033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749058962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749099970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749154091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749188900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749190092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.749224901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749258995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749259949 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.749289036 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.749294043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749327898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.749353886 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.800473928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.862227917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862297058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862334013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862368107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862400055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862431049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862452030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.862469912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.862579107 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.863223076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.863246918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.863284111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.909735918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.975471020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975492001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975507975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975523949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975539923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975555897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975573063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.975572109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.975647926 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.976330996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.976365089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.976381063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:24.976407051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:24.976434946 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.089262009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089282036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089291096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089298964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089306116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089314938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089323044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.089497089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.090202093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.090220928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.090236902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.090358019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.090358019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.214942932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.214970112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.214987040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215002060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215019941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215104103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.215286016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215301037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215317011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215332031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.215339899 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.215372086 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.269222021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.327879906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.327905893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.327922106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.328239918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.328248978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.328263998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.328279972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.328294992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.328306913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.328315973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.328342915 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.328368902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.329137087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.378619909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.442065001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442090034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442106009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442121983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442137003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442137957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.442153931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442169905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442171097 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.442186117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442202091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.442217112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.442245007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.555399895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555428982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555445910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555460930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555478096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555480957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.555521965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.555658102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555675030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555701971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.555840969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555860043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.555883884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.597217083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.668864012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.668889999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.668910027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.668926001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.668946981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.669065952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.669065952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.669275045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.669302940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.669322014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.669439077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.669439077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.669467926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.722306013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.782721996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782757998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782774925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782789946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782807112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782820940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782836914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782851934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782870054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.782934904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.782934904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.782934904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.831828117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.896116972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896163940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896199942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896234035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896266937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896294117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.896301031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896336079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.896532059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.896972895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.897016048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.897053003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:25.897100925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:25.897100925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.009782076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.009833097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.009850025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.009866953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.009886026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.009974003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.010035038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.010066986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.010087013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.010143042 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.010596037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.123526096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123595953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123645067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123749971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.123761892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123797894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123826981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.123830080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123863935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123881102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.123902082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.123945951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.124418020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.175353050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.237138987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237166882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237175941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237184048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237191916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237205982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237215042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237225056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.237509966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.238259077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.238312960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.238364935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.351553917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351607084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351680040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351713896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351748943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351782084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351799011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.351799011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.351815939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351847887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351877928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.351882935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.351896048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.394198895 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.465121984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465142965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465168953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465184927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465200901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465210915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465225935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.465300083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.465533972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.466182947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.466206074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.466223001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.466340065 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.466340065 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.578659058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.578684092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.578700066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.578707933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.578994989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579024076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579040051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579076052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.579076052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.579282999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579308987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579324961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579343081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.579431057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.579432011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.628643990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.692347050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692389011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692445040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692480087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692508936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692540884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.692540884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.692557096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692609072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692610025 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.692643881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692678928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692691088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.692711115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692749023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.692759037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.737871885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.806186914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806221962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806238890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806253910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806257010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.806269884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806286097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806289911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.806322098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806328058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.806360006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.806404114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.807293892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.847328901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.930941105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931006908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931042910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931077003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931083918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.931113005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931123018 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.931145906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931180954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931189060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.931214094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931251049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:26.931257963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:26.972214937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.043999910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044023037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044032097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044039011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044054985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044229984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.044370890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044416904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044433117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044450045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.044464111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.044549942 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.157807112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.157856941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.157886028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.157927036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.157944918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.157959938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.157993078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.158025026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.158061028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.158128023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.158128023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.206760883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.282087088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282108068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282124043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282140017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282155991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282207012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282255888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.282255888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.282255888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.282517910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282537937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282555103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282571077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:27.282578945 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:27.282618046 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.369844913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.369923115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.369959116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.369992971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370028973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370040894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370040894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370093107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370127916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370160103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370162964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370198965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370223999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370229959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370261908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370285988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370296955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370306969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370331049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370363951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370389938 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370397091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370430946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370448112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370517015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370552063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370587111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370620012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.370678902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370678902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370678902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.370845079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.371026993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.375699043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.375750065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.375788927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.375865936 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.375879049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.375920057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.375999928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.376255035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.376288891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.376322031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.376353025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.376386881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.376446962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.376446962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.376446962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.377038002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.377072096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.377104998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.377136946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.377147913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.377170086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.377182961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.377976894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.378032923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.378065109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.378082037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.378118038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.378145933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.378153086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.378204107 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.379030943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.379081011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.379115105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.379143000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.379146099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.379179955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.379189014 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.379996061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.380047083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.380064964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.380080938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.380114079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.380131006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.380147934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.380202055 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.381023884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.381076097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.381109953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.381124973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.381143093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.381175041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.381185055 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.381989956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.382039070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.382052898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.382071972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.382105112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.382118940 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.382138968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.382190943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.382920027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.382973909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.383006096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.383039951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.383039951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.383099079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.383738041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.383789062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.383835077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.384166002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.384218931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.384267092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.384270906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.384300947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.384332895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.384367943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.385190964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385222912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385252953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.385255098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385299921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.385720968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385754108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385787010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385817051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.385823965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.385873079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.419462919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419513941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419549942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419584036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419617891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419656038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419692039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419727087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.419734001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.419734001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.419761896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.420123100 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.532538891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532591105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532653093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532686949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532720089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532749891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.532756090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532749891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.532788992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532819986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.532824993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532857895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532867908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.532893896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.532972097 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.646513939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646559954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646619081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646656990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646689892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646708012 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.646708965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.646724939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646758080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646781921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.646795034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646827936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646862030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.646864891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.646913052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.760421038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760474920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760512114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760545969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760579109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760612965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760651112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760658026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.760683060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760720015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.760720968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.760746002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.816173077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.874172926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874203920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874217033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874223948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874233007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874238968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874245882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874250889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874258995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874269009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.874483109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.987837076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987862110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987876892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987890959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987906933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987921953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987932920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.987937927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987934113 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.987953901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.987971067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:28.988006115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:28.988006115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.035016060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.101644993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101715088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101732969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101748943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101766109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101782084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101800919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101815939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.101836920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.102116108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.215086937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215179920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215214014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215249062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215277910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215281963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.215311050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215344906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215368986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.215368986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.215378046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215425968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.215462923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215507030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.215552092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.328672886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328697920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328715086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328730106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328746080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328761101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328777075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328792095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328808069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.328864098 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.328865051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.328865051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.378561974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.442403078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442426920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442445040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442460060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442476034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442492008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442509890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442526102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442542076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.442605972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.442605972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.442605972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.442605972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.555737972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555763006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555778980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555794001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555809975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555824995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555840969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555851936 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.555855989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.555871964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.556113005 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.556113005 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.597384930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.676804066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676829100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676856041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676872015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676888943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676906109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.676918983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676935911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676951885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676958084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.676958084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.676970005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.676994085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.722347021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.802992105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803041935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803076982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803109884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803142071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803174973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803204060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.803209066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803205013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.803244114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803275108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.803282976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.803303003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.847207069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.916665077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916712046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916769981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916805983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916838884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916858912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.916858912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.916872978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916906118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916935921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.916940928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916973114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.916989088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:29.917010069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:29.917056084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.030116081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030150890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030169964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030194044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030209064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030224085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030237913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030253887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030268908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030282974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.030283928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.030283928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.030283928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.030333996 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.030333996 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.143902063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144001961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144038916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144072056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144105911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144105911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.144138098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144174099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144177914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.144177914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.144207001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144243002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.144251108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.191063881 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.257819891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.257869959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.257905960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.257937908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.257972956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.258004904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.258021116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.258021116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.258042097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.258074045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.258089066 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.258107901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.258115053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.258172035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.258215904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.371257067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371356964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371419907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371431112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.371454954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371490955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371499062 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.371522903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371557951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371592045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371629953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.371814966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.371814966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.425446033 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.484834909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.484924078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.484958887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.484993935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.485025883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.485027075 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.485059977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.485095024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.485097885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.485097885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.485130072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.485162973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.485172987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.534780025 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.600358009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600402117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600439072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600474119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600507021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600522041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.600522041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.600542068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600574017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600590944 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.600610018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600644112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600649118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.600682020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.600723028 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.712425947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712452888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712476015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712497950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712518930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712541103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712562084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712584972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712593079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.712593079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.712593079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.712605000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712627888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.712690115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.712691069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.826754093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.826797962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.826833963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.826868057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.826905012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.826940060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.826952934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.826952934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.826973915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.827008963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.827022076 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.827043056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.827074051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.827076912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.827136993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.939619064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939666986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939702988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939738035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939770937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939804077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939809084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.939810038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.939836025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939870119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939878941 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.939903021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939913988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:30.939937115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:30.939982891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.053451061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053502083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053539991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053575039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053610086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053644896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053674936 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.053678989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053711891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053739071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.053747892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.053754091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.097235918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398200035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398294926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398330927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398400068 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398417950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398452997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398479939 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398489952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398521900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398529053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398555994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398587942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398600101 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398619890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398654938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398669004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398689985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398700953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398721933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398756027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398762941 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398787975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398818970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398829937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398853064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398885012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398890018 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.398920059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.398962975 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.399050951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.399091959 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.406379938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406429052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406465054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406490088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.406497955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406533957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406541109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.406569004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406603098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406610012 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.406636953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406672001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.406677961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.456701994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.520065069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520107985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520126104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520134926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520142078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520149946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520165920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520178080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520193100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.520206928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.520292044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.633991003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634013891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634028912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634043932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634058952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634073019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634087086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634104013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.634110928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.634177923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.634177923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.634186983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.675393105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.747708082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747739077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747773886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747816086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747848988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747880936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747914076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747946978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.747956038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.747956038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.747956038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.747982979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.748028994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.800558090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.861382008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861466885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861521006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861553907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861589909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861598015 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.861598015 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.861627102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861661911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861673117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.861695051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861735106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.861741066 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.909849882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.975074053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975125074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975179911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975213051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975248098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975281954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975289106 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.975289106 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.975317001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975353003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975358963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:31.975421906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:31.975425005 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.019213915 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.096415997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096486092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096522093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096554995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096620083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096654892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096659899 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.096659899 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.096690893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096719980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096739054 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.096752882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096766949 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.096788883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.096837997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.209934950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.209959984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.209976912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.209990978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210006952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210031033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210046053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210059881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210076094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210092068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.210130930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.210131884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.210131884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.210232019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.323848963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.323919058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.323956013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.323988914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324013948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.324023962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324057102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324090004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324121952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324161053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324189901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.324193954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.324193954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.324193954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.324238062 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.437175035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437206030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437222958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437237024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437252045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437266111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437280893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437294960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437311888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.437366962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.437366962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.777725935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777764082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777779102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777801991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777818918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777833939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777832985 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.777848959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777863026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777870893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.777878046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777885914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.777893066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.777920961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.777949095 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778491974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778517008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778539896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778543949 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778553963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778568983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778583050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778592110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778598070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778611898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778626919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778634071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778640985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778656006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778661966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778671026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778676987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778686047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778700113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778704882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778717041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778733015 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778769016 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.778877020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778923988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778939009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.778965950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.779170990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.779253006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.892390966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892462015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892498016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892532110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892566919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892587900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.892587900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.892601013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892635107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892671108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892678022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.892709017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:32.892719984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:32.941088915 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.006293058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006342888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006380081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006412983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006453991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006493092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.006496906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006493092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.006541967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006572008 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.006578922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006618023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.006628036 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.050364017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.119332075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119364023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119379997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119452953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.119556904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119573116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119586945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119597912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.119602919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119616985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119637012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119649887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.119666100 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.119667053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.119688988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.233520031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233570099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233603954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233658075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233688116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.233691931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233721972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.233724117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233760118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233789921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.233793020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233901978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233938932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.233942986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.233989954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.346602917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346626043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346652031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346668959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346683025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346699953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346715927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346746922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.346776962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.346807957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346826077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346843004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.346990108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.346990108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.460249901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460273981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460290909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460320950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460339069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460355997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460372925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460387945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460407019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.460418940 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.460419893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.460505009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.574157953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574183941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574199915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574215889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574232101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574246883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574265957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574284077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.574357986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.574357986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.574357986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.574615955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.628645897 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.687887907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687912941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687922001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687928915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687937021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687944889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687953949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687961102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.687969923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.688262939 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.801434994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801486969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801522970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801556110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801578045 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.801592112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801616907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.801625967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801642895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801659107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801677942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.801820040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.847306013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.914589882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914705992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914724112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914740086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914756060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914772034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914783001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.914788008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914803982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914822102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:33.914828062 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.914854050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:33.956605911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.029009104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029062033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029097080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029161930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.029165030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029201031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029233932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029253006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029288054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029310942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.029377937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.029377937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.081727982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.142113924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142164946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142200947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142235041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142266035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.142301083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142316103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.142335892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142369986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142404079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142438889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.142556906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.142556906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.255978107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256028891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256063938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256098032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256130934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256162882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256180048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.256180048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.256196976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256228924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256258965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.256264925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.256319046 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.369761944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370027065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370052099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370069027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370085001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370100021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370115995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370131969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370148897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.370196104 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.370197058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.370197058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.370197058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.425350904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.483129978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483443975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483468056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483485937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483503103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483519077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483520985 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.483534098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483550072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483566046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.483635902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.483635902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.483635902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.597014904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597040892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597057104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597064972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597073078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597080946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597096920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597104073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597121954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.597184896 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.644228935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.710300922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710449934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710469007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710488081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710504055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710500002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.710515022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710520983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710547924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710563898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710578918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.710587978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.710618019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.710618973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.710618973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.824264050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824333906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824369907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824403048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824436903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824470043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824475050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.824475050 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.824502945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824537039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824544907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.824573994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.824579000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.878597975 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.937685013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937717915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937736034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937751055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937767982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937786102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937803030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937818050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937828064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.937828064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.937828064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.937834024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:34.937868118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:34.987832069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.051629066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051680088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051716089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051726103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.051749945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051784039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051790953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.051816940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051851988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051853895 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.051884890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.051918983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.051919937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.097204924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.177661896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177716970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177752972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177793980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177829981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177864075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177897930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177901030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.177901030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.177931070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177966118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.177977085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.177977085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.222347975 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.266755104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291002035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291038036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291090012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291121960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291153908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291184902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291210890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.291210890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.291210890 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.291218996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291268110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291284084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.291301012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.291347027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.404664993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404737949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404772043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404803991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404830933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.404838085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404865980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.404870987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404906988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404941082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.404977083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.405004978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.405109882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.405109882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.405109882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.518043995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518114090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518150091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518203974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518269062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518266916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.518266916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.518301964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518336058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518347979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.518369913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518403053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518415928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.518439054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.518481970 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.631867886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.631916046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.631951094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.631968021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.631983995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.632016897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.632041931 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.632049084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.632081985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.632083893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.632114887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.632148981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.632152081 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.675431013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.753485918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753536940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753571033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753603935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753628016 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.753640890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753659010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.753674984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753707886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753716946 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.753741026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753774881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.753781080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.800522089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.867505074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867557049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867590904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867624044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867662907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867695093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867729902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867731094 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.867731094 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.867763042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867805958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.867813110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.867813110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.909881115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.980722904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980776072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980812073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980846882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980880022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980911016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980945110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.980962992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.980962992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.980962992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:35.980978012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.981014013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:35.981041908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.034858942 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.093841076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.093863964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.093882084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.093939066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.093966961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.093976974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.093976974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.093983889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.094001055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.094016075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.094029903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.094028950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.094047070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.094053984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.094263077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.208375931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208399057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208408117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208415031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208421946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208429098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208436966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208444118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208457947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.208774090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.322004080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322074890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322139025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322173119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322208881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322238922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322271109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322303057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322333097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322334051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.322334051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.322335005 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.322365046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322400093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.322632074 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.322632074 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.362951040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.435627937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435677052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435714006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435748100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435781956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435810089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.435815096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435874939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435908079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435940027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.435940981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.435976028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.436043978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.549089909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549112082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549129963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549139023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549154997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549170017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549184084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549199104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549212933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549228907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.549278021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.549318075 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.663901091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.663949013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.663964033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.663981915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.663997889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.664012909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.664028883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.664045095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.664061069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.664096117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.664096117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.664096117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.664097071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.706680059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.781164885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781212091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781249046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781332970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781332016 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.781368017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781405926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781409979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.781440020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781472921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.781475067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781507969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781527996 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.781548023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.781619072 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.890800953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.890846968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.890883923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.890939951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.890974045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.891006947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.891025066 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.891025066 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.891041040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.891073942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.891107082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.891141891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:36.891148090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.891149044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:36.891233921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.004683018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004709005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004724979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004741907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004756927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004772902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004787922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004813910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004827976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004844904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.004930973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.004930973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.004930973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.004931927 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.117950916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.117975950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.117994070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118009090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118029118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118041992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118057013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118072987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118088961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118103981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.118143082 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.118144035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.118144035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.118144035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.230655909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230701923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230721951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230740070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230756998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230773926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230789900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230807066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230839968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230873108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.230988979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.230989933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.349037886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349090099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349128008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349162102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349195957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349227905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349250078 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.349251032 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.349260092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349292040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.349333048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.349334002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.349359989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.394196987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.457990885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458034992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458070040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458103895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458137989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458141088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.458173037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458173990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.458205938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458219051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.458240986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458271980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458306074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.458462954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.458462954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.571702003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571748018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571784019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571824074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571857929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571913004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571938038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.571938038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.571945906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.571980953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.572012901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.572029114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.572029114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.572047949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.572102070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.685235023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685302973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685338020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685390949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685419083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.685425997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685448885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.685458899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685506105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.685509920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685542107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685575008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685591936 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.685609102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.685650110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.807497978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807511091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807533026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807549953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807565928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807580948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807579041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.807600021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807625055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807640076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807642937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.807642937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.807656050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.807668924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.807688951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.927942991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928011894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928046942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928081036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928085089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.928113937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928119898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.928147078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928181887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928194046 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.928214073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928248882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:37.928252935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:37.972224951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.041585922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041608095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041636944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041654110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041670084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041687012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041701078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041717052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041732073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041747093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.041785002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.041785002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.041785002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.041785002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.041785002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.155545950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155599117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155637026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155669928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155695915 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.155704021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155730009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.155738115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155771017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155781031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.155806065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155837059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.155873060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.156033993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.156033993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.269192934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269289017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269376993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269411087 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.269412994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269448996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269476891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.269484043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269515991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269532919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.269551039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269584894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269594908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.269619942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.269661903 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.383007050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383059978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383095980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383128881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383162022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383196115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383214951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.383234978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383269072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383277893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.383305073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.383327961 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.425440073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.496671915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496722937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496757984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496793032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496825933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496834040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.496834040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.496859074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496891022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496905088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.496923923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496961117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.496988058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.550493002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.610028982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610104084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610140085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610173941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610203981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.610208988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610234022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.610241890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610275984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610285044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.610308886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610341072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610377073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.610486031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.610486031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.723697901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723767042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723802090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723834991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723836899 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.723867893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723874092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.723901033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723938942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.723970890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.724005938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.724057913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.724057913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.769211054 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.837766886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.837827921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.837863922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.837897062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.837907076 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.837929964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.837940931 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.837964058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.837996960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.838028908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.838063955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.838131905 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.838131905 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.878604889 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.951246977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951297045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951332092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951364040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951419115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.951419115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.951476097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951508999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951541901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951570988 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:38.951575041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951615095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:38.951617002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.003585100 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.065567017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065618038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065654993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065687895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065722942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065757036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065768003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.065768957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.065792084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065823078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065836906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.065855026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065864086 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.065918922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.065968990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.178678989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178754091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178790092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178822041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178855896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178864956 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.178864956 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.178889036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178921938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178930998 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.178953886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.178992033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.179028988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.179163933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.179163933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.292613983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292642117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292658091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292674065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292689085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292705059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292720079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292733908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292749882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.292767048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.292767048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.292809010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.441647053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.441694021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.441889048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.442080975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442128897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442164898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442198038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442229986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442250967 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.442250967 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.442262888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442295074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442327023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.442332029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.442393064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.577826023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.577896118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.577930927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.577965975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.577965021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.578000069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.578027964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.578035116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.578072071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.578082085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.578123093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.578166008 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.578176975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.578214884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.578258991 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.691767931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691812038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691847086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691879988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691911936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691942930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691975117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.691992998 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.691993952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.691993952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.692008018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.692039967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.692073107 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.692075968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.692126036 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.805294037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805362940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805381060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805396080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805412054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805427074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805422068 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.805443048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805457115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805470943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805483103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.805494070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.805494070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.805522919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.805522919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.918664932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918683052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918693066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918697119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918701887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918710947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918720961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918730021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918739080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:39.918864965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:39.918864965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.032586098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032635927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032672882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032706022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032722950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032738924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032754898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032771111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032788992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.032835007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.032919884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.146723986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146773100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146811008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146846056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146878958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146913052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146949053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146981955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.146981955 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.146982908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.146982908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.147017956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.147056103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.191225052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.260231018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260255098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260272026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260287046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260303020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260318995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260334015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260349989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260368109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.260396957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.260397911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.260397911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.260397911 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.316128969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.373744965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373779058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373796940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373811960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373828888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373843908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373859882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373874903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373893023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.373958111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.373959064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.373959064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.425359011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.488612890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488666058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488701105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488734007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488759041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.488769054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488801003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488818884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.488836050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488869905 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.488871098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488908052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.488925934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.534853935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.627446890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627496004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627532005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627563000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627563953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.627603054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627616882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.627635956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627670050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627685070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.627701998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627737999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.627748013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.675357103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.715137959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715209007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715244055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715281963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715317965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715317011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.715352058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715379000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.715415001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715428114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.715456963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715495110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715507984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.715523958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.715569973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.828293085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828315973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828331947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828347921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828373909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.828411102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.828454018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828506947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828522921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828546047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.828573942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828591108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.828612089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.878536940 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.941955090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.941994905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942162991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942162991 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.942189932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942204952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942224026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942236900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.942262888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.942271948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942286968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942303896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:40.942322969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:40.987999916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.055450916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055583954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055597067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055632114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.055653095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055669069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055682898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055691957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.055696964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055716991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055725098 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.055732012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055747032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.055764914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.055783987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.169424057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169449091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169466019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169481039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169496059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169511080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169526100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169540882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169555902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169572115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.169598103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.169599056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.169599056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.169599056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.169701099 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.283004999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283051968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283087015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283118963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283119917 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.283155918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283173084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.283257008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283324003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283339977 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.283359051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.283436060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.283471107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.331763983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.396725893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396747112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396764040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396778107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396795034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396797895 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.396810055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396826029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.396826982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396841049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396858931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.396861076 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.396883965 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.440967083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.510586023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510607958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510631084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510641098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510648966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510657072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510664940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510672092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510679960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510689974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.510971069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.624052048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624119043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624155045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624180079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.624187946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624222040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624229908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.624254942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624289989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624299049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.624321938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624357939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.624365091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.675426006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.738017082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738065958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738100052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738132000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738166094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738198042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738231897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738244057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.738244057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.738244057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.738266945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738302946 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.738317966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.784815073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.852128029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852226019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852261066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852294922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852312088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852318048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.852344036 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.852345943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852365017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852397919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.852399111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852433920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.852505922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.965817928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965854883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965872049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965888023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965903997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965919018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965936899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965953112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965953112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.965970039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:41.965997934 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:41.966007948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.079092026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079142094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079178095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079197884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.079210043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079242945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079257011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.079277039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079309940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079341888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079377890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.079493999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.079493999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.128470898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.192687988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192740917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192776918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192810059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192843914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192876101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192909956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192944050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192979097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.192996979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.192996979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.192996979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.192996979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.237943888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.306401014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306440115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306456089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306471109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306485891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306502104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306518078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306557894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.306557894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.306557894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.306626081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.306771994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.306858063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.350466967 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.419805050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419838905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419855118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419872046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419888020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419903040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419908047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.419919014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419934988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419951916 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.419958115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.419971943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.472388029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.533665895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533718109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533755064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533787966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533821106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533854008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533860922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.533860922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.533894062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533904076 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.533926964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.533967018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.534081936 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.581724882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.647532940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647583961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647619963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647655010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647690058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647722006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647730112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.647730112 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.647757053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647764921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.647797108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.647835016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.648020983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.690994978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.760798931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.760848045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.760885000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.760895014 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.760917902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.760957956 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.760958910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.760992050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.761027098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.761039019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.761059999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.761096954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.761125088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.816078901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.874450922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874475002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874490976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874505997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874521971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874538898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874556065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874571085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874588013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.874649048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.874650002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.874650002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.874650002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.925456047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.988069057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988140106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988176107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988207102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.988209963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988244057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988255978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.988277912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988312960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988342047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:42.988346100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988384008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:42.988389969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.034744024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.129977942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130112886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130134106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130151033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130165100 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.130167961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130183935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130198002 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.130198956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130215883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130227089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.130230904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.130255938 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.175343990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.257421017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257463932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257519960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257549047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.257555008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257587910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257601976 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.257643938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257677078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257689953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.257713079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257745981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257772923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.257791042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.257838964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.381676912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381724119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381759882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381793022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.381795883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381830931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381836891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.381865978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381899118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381926060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.381932974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381967068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.381980896 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.382004023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.382175922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.504142046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504220963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504256964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504272938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504290104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504306078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504323959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504338980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504359007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.504458904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.617559910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617630959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617671013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617703915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617732048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.617738962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617769003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617810011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617844105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617876053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617903948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.617903948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.617913008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.617917061 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.617960930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.731447935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731494904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731553078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731565952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.731591940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731626034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731662989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731676102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.731697083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731709003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.731731892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731765032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731801987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.731811047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.731854916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.845036983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845127106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845146894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845165014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845196962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845211983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.845235109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845252037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.845268011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845304966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845315933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.845340014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.845347881 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.894176960 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.958848953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.958899021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.958935976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.958949089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.958970070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.959006071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.959022999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.959039927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.959074974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.959083080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:43.959109068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.959147930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:43.959187984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.072346926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072398901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072433949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072468042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072503090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072532892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072566032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072592020 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.072592020 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.072598934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072628021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.072632074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072670937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.072679043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.073908091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.186184883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186239004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186278105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186311960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186346054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186357021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.186378956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186393976 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.186413050 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186444998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186460972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.186480045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.186490059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.237835884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.299662113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299736023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299771070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299803972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299830914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.299838066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299865007 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.299871922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299906969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299938917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299959898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.299973965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.299982071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.347209930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.413537979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413589001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413650036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413685083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413695097 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.413718939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413748026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.413754940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413788080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413822889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413841963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.413855076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.413876057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.413892984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.419686079 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.527301073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527436018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527470112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527492046 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.527503967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527539968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527546883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.527573109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527611971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.527627945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527662992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527697086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527704000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.527731895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.527771950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.640687943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640789986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640845060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640846014 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.640881062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640914917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640923977 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.640952110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640985012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.640994072 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.641020060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.641056061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.641058922 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.690994978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.754324913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754412889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754445076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754473925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.754492044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754539013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.754548073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754581928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754615068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754625082 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.754647970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754683018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754692078 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.754717112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.754759073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.868469000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868578911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868596077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868612051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868628979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868644953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868642092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.868660927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868676901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.868678093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.868700981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.868722916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.868793964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.909751892 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.982928991 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983000994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983040094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983062029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.983076096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983109951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983125925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.983143091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983176947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983190060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:44.983211040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983247042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:44.983258963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.034718990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.095779896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.095875025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.095910072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.095943928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.095943928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.095977068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.096004963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.096010923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.096043110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.096070051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.096077919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.096112013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.096129894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.144083023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.209408998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209482908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209518909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209548950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.209574938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209611893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209624052 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.209649086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209683895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209712982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.209713936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209747076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209760904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.209784985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.209829092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.339452028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339519024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339554071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339582920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.339586973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339620113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339644909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.339656115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339692116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339704990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.339724064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339761019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.339771032 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.394113064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.453092098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453138113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453198910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453226089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.453236103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453269958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453283072 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.453305960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453339100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453350067 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.453373909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453406096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453419924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.453440905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.453481913 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.566685915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566747904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566785097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566808939 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.566819906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566854954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566879034 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.566889048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566922903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566936970 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.566957951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.566993952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.567008972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.612854004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.680394888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680447102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680480957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680505037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.680515051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680551052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680567026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.680586100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680620909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680638075 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.680658102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680696011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.680708885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.722186089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.793741941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793787956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793823957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793829918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.793859959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793895006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793908119 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.793927908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793962955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.793968916 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.793998003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.794034958 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.794472933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.795281887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.795336008 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.907470942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907542944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907578945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907604933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.907613993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907649040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907659054 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.907682896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907717943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907733917 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.907752037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907793999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:45.907804966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:45.956589937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.021155119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021224022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021260023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021275997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.021292925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021328926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021342039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.021363020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021397114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021409035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.021430969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021469116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.021480083 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.065979004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.303783894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.303848982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.303885937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.303914070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.303920984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.303957939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.303963900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.303992033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304028034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304038048 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304061890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304095030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304100990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304130077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304162979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304172039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304195881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304208040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304230928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304264069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304275990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304299116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304330111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304338932 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304364920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304399014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304409027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.304433107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304470062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.304476976 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.347212076 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.362123966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362164021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362217903 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.362222910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362278938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362318039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.362332106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362368107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362401009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362412930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.362435102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362468004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362500906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.362505913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.362551928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.476296902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476349115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476385117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476417065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476438999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.476452112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476479053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.476485014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476520061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476535082 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.476552963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476588964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.476598978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.519090891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.599452972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599504948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599544048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599575043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.599577904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599613905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599631071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.599653006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599685907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599698067 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.599720955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599759102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.599759102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.644097090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.703078985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703108072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703125000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703155041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703171015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703178883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.703186989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703202963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703210115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.703217983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703228951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.703236103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.703253031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.753488064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.817542076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817595959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817629099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817682981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817696095 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.817715883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817738056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.817748070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817786932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817812920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.817817926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817851067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.817873001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.862879992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.930397034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930449009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930464029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930480003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930501938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930510044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.930510044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.930517912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930532932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930546999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930557966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.930562973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:46.930587053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:46.972220898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.044281960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044349909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044384003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044406891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.044418097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044454098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044465065 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.044487000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044522047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044533968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.044553995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044589996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.044600010 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.097214937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.157840967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.157905102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.157958031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.157958031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.158010960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.158044100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.158061981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.158078909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.158111095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.158138037 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.158145905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.158179998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.158193111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.206584930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.283787966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.283839941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.283894062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.283911943 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.283927917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.283979893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.283982992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.284017086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.284049988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.284077883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.284084082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.284116983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.284135103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.284200907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.284248114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.397448063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397490025 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397504091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397521019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397532940 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.397536039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397550106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397562027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.397566080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397583008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397588968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.397600889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.397634029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.440960884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.511156082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511369944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511426926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511428118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.511460066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511492968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511502981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.511527061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511559963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511568069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.511598110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511626005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.511634111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.512295961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.512342930 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.624888897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.624944925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.624983072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.625010967 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.625014067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.625050068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.625065088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.625082016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.625121117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.625133038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.625153065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.625200033 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.625210047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.675352097 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.738737106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738771915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738789082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738804102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738812923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.738821030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738846064 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738851070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.738863945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738878965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738898039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738898039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.738913059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.738922119 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.738956928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.852317095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852339983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852356911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852371931 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852389097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852401972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.852405071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852420092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852435112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852438927 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.852452993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.852458954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.852472067 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.894104004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.966217995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966243029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966264009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966272116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966280937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966295958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966310978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966325998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966344118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.966445923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:47.966939926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:47.967019081 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.079792023 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.079854965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.079890966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.079926968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.079982042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.080010891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.080044031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.080049038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.080079079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.080111027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.080149889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.080183983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.080244064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.193650961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193701982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193718910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193747044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193747997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.193763971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193780899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193794966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.193798065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193818092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193835020 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.193837881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.193866014 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.237871885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.307598114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307621956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307638884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307653904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307671070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307684898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307698011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.307701111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307715893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307734013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.307755947 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.307780027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.437582970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437618971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437635899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437650919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437673092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437676907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.437689066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437699080 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.437705994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437721968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437726021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.437737942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.437763929 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.487838984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.534703970 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534761906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534775972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534790993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534806967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534821033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534837008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534851074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.534907103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.535036087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.535052061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.535074949 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.535101891 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.648454905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648545027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648576021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648602009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.648611069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648648977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648663044 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.648715973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648756027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.648767948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648801088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648834944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648839951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.648870945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.648910999 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.762178898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762262106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762294054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762329102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762329102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.762363911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762372971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.762398005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762433052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762440920 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.762468100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762511015 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.762518883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762550116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.762599945 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.876389980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876415968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876432896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876449108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876465082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876480103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876487017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.876496077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876512051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876528978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.876529932 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.876574039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.925335884 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.990289927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990380049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990412951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990447998 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990458012 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.990480900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990506887 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.990514994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990547895 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990570068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990573883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:48.990586042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:48.990612984 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.034737110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.103477955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103524923 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103575945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103589058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.103610039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103645086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103671074 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.103678942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103713989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103743076 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.103745937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103777885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103802919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.103810072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.103862047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.217145920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217185974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217221975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217248917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217272043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217288017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217302084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217319012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217333078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217348099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.217381954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.217430115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.333415031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333447933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333460093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333475113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333491087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333499908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.333520889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333534002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333544970 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.333550930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333564043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333568096 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.333579063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.333616972 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.333626032 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.446894884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.446928024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.446979046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447011948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447015047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.447043896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447072983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.447077036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447110891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447143078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447144985 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.447175980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447192907 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.447208881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.447271109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.560762882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.560823917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.560858011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.560890913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.560904980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.560925007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.560935974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.560957909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.560990095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.561005116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.561022997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.561055899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.561068058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.612898111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.674503088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674580097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674611092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674649000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.674664021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674698114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674722910 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.674731016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674763918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674777031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.674798012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674829960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674841881 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.674863100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.674911976 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.788391113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788424969 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788439989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788456917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788480997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788496971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788497925 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.788511992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788531065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788535118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.788588047 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.788614035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788702011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.788743973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.902151108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902209997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902264118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902264118 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.902297020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902328968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902345896 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.902362108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902394056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902406931 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.902430058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.902475119 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:49.902475119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:49.956598043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.015500069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015523911 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015548944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015563965 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015578985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015583992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.015594006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015611887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015628099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015634060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.015645981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.015674114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.015674114 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.066051006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.129820108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129839897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129856110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129870892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129885912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129903078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129918098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129934072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129947901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.129970074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.130043030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.130099058 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.243098974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243187904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243222952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243256092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243254900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.243289948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243311882 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.243321896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243355036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243366957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.243410110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243443966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.243453979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.284871101 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.356343985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356388092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356451988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356477976 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.356486082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356518030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356540918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.356554031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356585979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356601000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.356620073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356653929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356663942 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.356688976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.356751919 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.470159054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470179081 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470195055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470208883 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470225096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470232964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.470238924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470268011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470271111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.470283031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470289946 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.470299006 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470314980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.470324993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.470366955 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.584230900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584275007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584290981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584306955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584316969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.584321976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584337950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584352016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584357023 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.584367990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584383011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.584388018 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.584408045 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.628472090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.697830915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697884083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697901011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697916031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697931051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697946072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697961092 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697976112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.697992086 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.698084116 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.811050892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811086893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811103106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811132908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811167002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811198950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811203003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.811233997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811255932 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.811269999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.811326027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.811410904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.862858057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.924917936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925090075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925167084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.925215960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925417900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925451994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925466061 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.925486088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925517082 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925529003 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.925551891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.925596952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:50.925604105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:50.972218990 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.038614988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038660049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038674116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038697958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038712978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038722038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.038727045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038742065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038743973 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.038758039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038772106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038786888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.038795948 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.038827896 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.152266026 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152412891 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152429104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152436018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152442932 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152461052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152484894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152489901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.152501106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152515888 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.152549982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.206619024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.278739929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278759956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278785944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278801918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278815031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.278817892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278835058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278841019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.278841972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278851032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.278935909 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.278990984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.279112101 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.279155016 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.392621040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392694950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392730951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392765045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392786026 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.392801046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392813921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.392833948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392867088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392875910 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.392899036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392935038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.392944098 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.441050053 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.507051945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507230997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507283926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507308960 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.507347107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507380962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507416964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.507461071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507477999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507493019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507509947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.507534981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.507637978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.620628119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620697021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620731115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620758057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.620764017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620798111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620822906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.620883942 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620919943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.620934963 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.620953083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.621014118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.621032953 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.675436974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.735289097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735379934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735405922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735440016 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.735445976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735460997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735476971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735486031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.735532999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735548973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735563040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.735668898 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.735670090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.849221945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849292040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849330902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849364042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849370956 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.849399090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849421024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.849431992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849467039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849482059 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.849499941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849538088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.849550009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.894098043 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.962670088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962697029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962795973 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962816954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962835073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962843895 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.962852001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962868929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962918997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.962918997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.962934971 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962954044 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962973118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:51.962982893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:51.963017941 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.074762106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074822903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074846983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074858904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074877977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074889898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074899912 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074911118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.074929953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.075007915 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.075160027 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.188286066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188322067 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188338995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188354015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188369989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188385010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188400984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188415051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188431978 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.188489914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.188553095 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.301893950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.301942110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.301974058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.301994085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.302004099 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.302015066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.302035093 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.302057981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.302057981 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.302077055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.302078009 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.302100897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.302119017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.347326040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.415658951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415692091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415709972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415724039 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415739059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415751934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415749073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.415766954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415776014 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.415781975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415797949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.415819883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.415843964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.530567884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530658007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530705929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530735970 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.530750036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530795097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530838966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530883074 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530925989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530930996 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.530930996 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.530975103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.530985117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.581614017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.642976999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.642995119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643007994 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643019915 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643035889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643047094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643059015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643064022 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.643069983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643084049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.643234968 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.756532907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756580114 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756596088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756611109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756628990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756644964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756659985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756675959 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756699085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.756840944 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.757168055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.757332087 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.870181084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870208979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870223999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870238066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870254993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870277882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870294094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870307922 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870325089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.870343924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.870604992 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.870963097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.871043921 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.984029055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984101057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984137058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984169960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984194994 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.984204054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984236002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984268904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984299898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984338999 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:52.984390974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.984390974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:52.984390974 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.034729004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.097595930 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097655058 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097688913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097702980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.097722054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097754955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097765923 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.097794056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097826958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097855091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.097860098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.097902060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.097909927 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.144241095 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.211129904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211179972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211230993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211232901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.211261988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211294889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211308956 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.211327076 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211359024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211370945 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.211420059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211452007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211468935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.211481094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211515903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.211527109 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.253484964 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.324866056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.324911118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.324947119 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.324981928 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.324981928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.325027943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.325052977 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.325083017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.325115919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.325134039 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.325150013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.325181961 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.325197935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.325220108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.325259924 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.445133924 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445183992 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445250034 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.445372105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445408106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445465088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.445502996 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445540905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445594072 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445602894 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.445626974 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445672035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.445679903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445713043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.445771933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.559094906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559123993 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559149981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559165955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559180975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559191942 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.559196949 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559211016 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559227943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559230089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.559251070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.559269905 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.559286118 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559315920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.559356928 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.672780037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672805071 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672822952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672838926 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672854900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672862053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672869921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672877073 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.672894001 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.673063993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.673064947 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.786179066 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786233902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786271095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786304951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.786345005 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786395073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.786396980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786432028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786463976 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786487103 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.786497116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786531925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.786542892 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.831612110 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.900057077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900113106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900146008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900178909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900185108 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.900213003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900223017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.900244951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900278091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900290966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.900310040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900345087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:53.900352955 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:53.941003084 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.013818979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.013871908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.013911963 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.013926983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.013945103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.013978958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.013991117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.014012098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.014045000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.014060020 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.014079094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.014116049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.014126062 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.065964937 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.127362013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127433062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127490997 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127500057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.127526045 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127558947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127573013 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.127597094 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127629042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127648115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.127666950 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127700090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127723932 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.127734900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127784967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.127788067 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.175348997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.241122007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241168022 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241202116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241233110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241235018 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.241266012 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241297007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241301060 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.241332054 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241357088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.241363049 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241396904 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.241420031 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.284781933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.355340004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355420113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355463982 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355499983 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355511904 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.355534077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355570078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355573893 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.355606079 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355637074 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.355643034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355676889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.355693102 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.409742117 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.468514919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468584061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468619108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468645096 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.468652964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468688011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468700886 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.468720913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468755007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468764067 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.468786955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468822956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.468842983 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.519288063 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.581729889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.581772089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.581826925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.581836939 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.581881046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.581913948 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.581942081 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.581948042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.581980944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.582009077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.582012892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.582043886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.582072020 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.582078934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.582123995 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.695240021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695297956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695333004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695348024 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.695365906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695417881 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.695420027 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695451975 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695485115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695512056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.695523977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.695595980 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.695646048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.737858057 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.808857918 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.808917046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.808975935 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.808984995 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.809030056 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.809062004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.809087038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.809096098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.809129000 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.809145927 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.809161901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.809195042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.809211969 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.862873077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.922635078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922739029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922791958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922805071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.922830105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922863960 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922883987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.922899008 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922950029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.922975063 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.922985077 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.923017979 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:54.923038006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:54.972266912 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.036528111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036595106 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036653042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036658049 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.036709070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036758900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036765099 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.036793947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036827087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036854029 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.036860943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036900043 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.036925077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.081613064 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.150530100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150556087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150572062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150588036 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150604010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150619030 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150635004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150650024 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150666952 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.150762081 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.150762081 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.191118956 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.264013052 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264034986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264051914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264080048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264095068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264111042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264126062 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264143944 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264157057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264174938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.264252901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.264252901 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.264254093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.391884089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.391930103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.391987085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392024040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392030954 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.392057896 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392091990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392095089 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.392123938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392153025 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.392158031 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392190933 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392226934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.392227888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.392342091 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.505726099 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505759954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505776882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505791903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505809069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505824089 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505839109 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505846977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505865097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.505894899 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.505975008 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.550524950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.619373083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619451046 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619510889 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619545937 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619549036 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.619577885 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619611025 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.619613886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619659901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619699955 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619716883 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.619729042 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619760990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619781971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.619800091 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.619827986 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.659821987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.733159065 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733213902 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733247995 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733279943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733295918 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.733313084 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733333111 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.733345032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733377934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733392000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.733409882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733442068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.733457088 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.784873962 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.846836090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.846900940 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.846935987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.846967936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.846999884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.847032070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.847064972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.847078085 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.847095966 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.847130060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.847160101 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.847263098 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.960247040 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960314989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960350037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960371017 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.960382938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960414886 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960431099 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.960453033 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960505009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960509062 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:55.960539103 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960572958 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:55.960589886 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.003568888 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.074532032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074580908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074616909 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074651003 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074681997 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.074687004 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074721098 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074749947 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.074755907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074784040 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.074789047 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074826956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.074840069 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.128525019 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.187671900 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187726021 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187783957 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.187792063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187829018 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187863111 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187872887 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.187896967 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187931061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187943935 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.187963009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.187999010 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.188008070 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.237859011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.301501989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301541090 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301592112 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301624060 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301659107 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301691055 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301723957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301755905 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301780939 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.301790953 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.301855087 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.301902056 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.415189981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415247917 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415282011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415314913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415316105 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.415350914 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415374041 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.415381908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415443897 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415469885 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.415478945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415510893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415538073 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.415546894 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.415594101 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.528606892 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528659105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528697968 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528748035 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.528776884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528830051 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528836966 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.528866053 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528899908 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528934956 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528970957 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.528989077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.528989077 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.581604004 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.643456936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643495083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643511057 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643527985 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643542051 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.643546104 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643567085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643579006 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.643584013 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643600941 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.643608093 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.643642902 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.644048929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.691015005 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.757138014 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757172108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757198095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757215977 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757231951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757229090 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.757247925 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757263899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757282019 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.757288933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.757288933 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.757328987 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.757489920 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.800364971 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.871002913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871077061 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871093988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871109009 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871123075 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871138096 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871153116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871167898 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871182919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.871207952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.871243000 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.984615088 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984683990 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984719038 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984750986 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984755993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.984785080 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984813929 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.984813929 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984847069 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984860897 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.984882116 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.984925985 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:56.986145020 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.986179113 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:56.986233950 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.098099947 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098165989 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098200083 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098233938 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098268032 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098300934 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098332882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098365068 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098364115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.098401070 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.098426104 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.098488092 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.215468884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215496063 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215512037 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215518951 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215528011 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215544939 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215615988 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215631962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215703011 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.215708017 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215761900 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.215766907 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.215879917 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.335664034 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335685015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335700035 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335714102 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335772038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.335805893 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335822105 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335832119 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.335839987 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335855007 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335865021 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.335870981 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.335899115 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.378535032 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.454349041 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454365015 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454387903 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454441071 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.454564095 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454579115 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454592943 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454607964 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454622030 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.454622984 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.454663038 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.454687119 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.455554962 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.455570936 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.455631018 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.578603029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578645945 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578661919 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578679085 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578687906 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.578692913 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578708887 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578716993 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.578725100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578739882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578748941 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.578757048 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.578783989 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.628552914 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.692403078 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692424059 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692447901 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692462921 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692480087 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692487001 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.692495108 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692509890 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692524910 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692532063 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.692554951 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.692567110 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.692574978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.737869978 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.806164980 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806183100 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806197882 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806236982 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.806269884 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806286097 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806301117 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806315899 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.806319952 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.806339979 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.808743954 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.808760881 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.808798075 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.862958908 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.919965029 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.920049906 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.920063972 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.920128107 CEST	49747	8686	192.168.2.4	45.137.222.18
Oct 12, 2024 16:38:57.920140028 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.920156002 CEST	8686	49747	45.137.222.18	192.168.2.4
Oct 12, 2024 16:38:57.920170069 CEST	8686	49747	45.137.222.18	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 12, 2024 16:38:08.838469982 CEST	192.168.2.4	1.1.1.1	0x6948	Standard query (0)	contr.netmows.com	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:48.295479059 CEST	192.168.2.4	1.1.1.1	0x84e9	Standard query (0)	contr.netmows.com	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:53.704746962 CEST	192.168.2.4	1.1.1.1	0xb04f	Standard query (0)	ddns.oray.com	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:54.889869928 CEST	192.168.2.4	1.1.1.1	0x7827	Standard query (0)	pool.autocoreb.com	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:40:47.679919004 CEST	192.168.2.4	1.1.1.1	0xdafa	Standard query (0)	contr.netmows.com	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:41:47.934832096 CEST	192.168.2.4	1.1.1.1	0x37e4	Standard query (0)	contr.netmows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 12, 2024 16:38:08.872956038 CEST	1.1.1.1	192.168.2.4	0x6948	No error (0)	contr.netmows.com	45.137.222.18	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:48.368310928 CEST	1.1.1.1	192.168.2.4	0x84e9	No error (0)	contr.netmows.com	45.137.222.18	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:53.943770885 CEST	1.1.1.1	192.168.2.4	0xb04f	No error (0)	ddns.oray.com	114.215.199.192	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:53.943770885 CEST	1.1.1.1	192.168.2.4	0xb04f	No error (0)	ddns.oray.com	114.215.189.130	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:55.073591948 CEST	1.1.1.1	192.168.2.4	0x7827	No error (0)	pool.autocoreb.com	116.202.251.6	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:55.073591948 CEST	1.1.1.1	192.168.2.4	0x7827	No error (0)	pool.autocoreb.com	141.255.164.11	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:39:55.073591948 CEST	1.1.1.1	192.168.2.4	0x7827	No error (0)	pool.autocoreb.com	116.202.251.16	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:40:47.704205990 CEST	1.1.1.1	192.168.2.4	0xdafa	No error (0)	contr.netmows.com	45.137.222.18	A (IP address)	IN (0x0001)	false
Oct 12, 2024 16:41:48.116074085 CEST	1.1.1.1	192.168.2.4	0x37e4	No error (0)	contr.netmows.com	45.137.222.18	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50024	114.215.199.192	80	4296	C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

Timestamp	Bytes transferred	Direction	Data
Oct 12, 2024 16:39:53.957799911 CEST	99	OUT	GET /checkip HTTP/1.1 User-Agent: WinInetGet/0.1 Host: ddns.oray.com Cache-Control: no-cache
Oct 12, 2024 16:39:54.910218000 CEST	171	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 12 Oct 2024 14:39:54 GMT Content-Type: text/html Content-Length: 31 Connection: keep-alive Data Raw: 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: Current IP Address: 8.46.123.33

Target ID:	0
Start time:	10:38:01
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\R4WCgDAfHB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R4WCgDAfHB.exe"
Imagebase:	0x3b0000
File size:	422'352 bytes
MD5 hash:	8595A9CECBAC3BD363C30C7AB2BEC849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:38:06
Start date:	12/10/2024
Path:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SystemNvwmiShell\NvwmiShell.exe"
Imagebase:	0x880000
File size:	79'073'664 bytes
MD5 hash:	FC4FBC1A020E2DC3D073C666684B5C6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:38:07
Start date:	12/10/2024
Path:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SystemNvwmiShell\NvwmiShell.exe
Imagebase:	0x880000
File size:	79'073'664 bytes
MD5 hash:	FC4FBC1A020E2DC3D073C666684B5C6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000003.2738458849.000000000275E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 00000002.00000003.2738458849.0000000002163000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:39:48
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:39:48
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:39:48
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:39:52
Start date:	12/10/2024
Path:	C:\Program Files (x86)\Microsoft Network\HelpSystem.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Network\HelpSystem.exe" 1
Imagebase:	0x400000
File size:	89'349'120 bytes
MD5 hash:	34B640C3E7AE045FE1F156B755BB0BE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:39:52
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:39:54
Start date:	12/10/2024
Path:	C:\Program Files (x86)\Microsoft Network\Network64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Network\Network64.exe" Yde5fFJFjShqKS+u9okdyvP/pj9kg/bQNXV+USrRGaecQs8AdtikoR9wVLreBlqoPAFr/LRRDydtLzX5YzQgQ1GCivTcd3opL1Xfv4SzrZQOBZVgTwOiPgknymhzPAuX3kaHX0i00NQybzCyaJaj7nJOK0DHJVp09YDF1A==
Imagebase:	0x400000
File size:	97'341'952 bytes
MD5 hash:	A09B6784FF89670772817524BFE41A76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.4141872839.00000000009EA000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 0000000C.00000001.2805127434.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000000.2804854911.00000000009EA000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 0000000C.00000002.4141120724.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: unknown Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 0000000C.00000000.2804283551.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:39:54
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1779
Total number of Limit Nodes:	71

Executed Functions

Function 100019D0 Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 172serviceregistrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10001A0F
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 10001A3B
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 10001A67
LockServiceDatabase.ADVAPI32(?), ref: 10001A74
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 10001A8B
UnlockServiceDatabase.ADVAPI32(00000000), ref: 10001A92
GetLastError.KERNEL32 ref: 10001AA2
OpenServiceA.ADVAPI32(?,?,000F01FF), ref: 10001ABA
StartServiceA.ADVAPI32 ref: 10001AD3
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 10001ADA
RegOpenKeyA.ADVAPI32(80000002,?,00000000), ref: 10001B3F
lstrlen.KERNEL32 ref: 10001B86
RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,00000000), ref: 10001B9C
RegCloseKey.KERNELBASE(00000000), ref: 10001BA7
CloseServiceHandle.ADVAPI32(00000000), ref: 10001BC0
CloseServiceHandle.ADVAPI32(?), ref: 10001BC7

Strings

e, xrefs: 10001B51
t, xrefs: 10001B6E
o, xrefs: 10001B77
n, xrefs: 10001B7C
p, xrefs: 10001B69
c, xrefs: 10001B5B
r, xrefs: 10001B60
D, xrefs: 10001B4C
s, xrefs: 10001B56

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Service$CloseOpen$DatabaseHandleStart$ChangeConfig2CreateErrorLastLockManagerUnlockValue_memsetlstrlen
String ID: D$c$e$n$o$p$r$s$t
API String ID: 2185839690-1025341413
Opcode ID: 37f2617e90ae54baca2fbbffeea3fcef389650bc486e0ea2d9f1abbc8d4c6943
Instruction ID: cb487d3376347de1c1cc0c83f22978b7210f4ae86925edaab3ca3a6e2c12f8e1
Opcode Fuzzy Hash: 37f2617e90ae54baca2fbbffeea3fcef389650bc486e0ea2d9f1abbc8d4c6943
Instruction Fuzzy Hash: 8D5108715083859FE311DF68CC48B9BBBE8EF89784F044A4CF58997242DBB5E904C7A2

Function 100016E0 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,04B08C62), ref: 100016F4
OpenProcessToken.ADVAPI32(00000000), ref: 100016FB
LookupPrivilegeValueA.ADVAPI32 ref: 10001768
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 10001793
CloseHandle.KERNELBASE ref: 1000179D

Strings

D, xrefs: 10001734
S, xrefs: 1000172B
r, xrefs: 1000174C
b, xrefs: 1000173D
u, xrefs: 10001742
l, xrefs: 10001756
P, xrefs: 10001747
v, xrefs: 10001751

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: D$P$S$b$l$r$u$v
API String ID: 3038321057-2680133038
Opcode ID: 0f8f09506c273f14d7940b5691eb4955810dc2d5a6b1d75380ef4c560048f307
Instruction ID: 806b9db3c9720ce491169ecc7032a5b6b3028df8eea08869397e21aa1dcb501e
Opcode Fuzzy Hash: 0f8f09506c273f14d7940b5691eb4955810dc2d5a6b1d75380ef4c560048f307
Instruction Fuzzy Hash: 45210E6010D3C0DEE305DB648885B5BBFE4AFAD748F044A4CF1C856292C6B9D648CB6B

Function 00882175 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 008821A7

Part of subcall function 00881F38: __CxxThrowException@8.LIBCMT ref: 00884811
Part of subcall function 00881F38: __cftof.LIBCMT ref: 00884828

Part of subcall function 0088FA94: __getptd_noexit.LIBCMT ref: 0088FA94

GetLocaleInfoA.KERNELBASE(00000800,00000003,?,00000004), ref: 008821BF
__snwprintf_s.LIBCMT ref: 008821F4
LoadLibraryA.KERNELBASE(?), ref: 0088222F

Strings

LOC, xrefs: 0088219F

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Exception@8InfoLibraryLoadLocaleThrow__cftof__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1016519223-519433814
Opcode ID: 621ab4c9934d9140269f2f839482d4588271683df52faa62a8d0139f99bf38ad
Instruction ID: 9bdc9ee729a2681a055d4e50dedc492d73a83003044fc32bdf20749489f62745
Opcode Fuzzy Hash: 621ab4c9934d9140269f2f839482d4588271683df52faa62a8d0139f99bf38ad
Instruction Fuzzy Hash: A521A271A4021DAADB14BB68CC4ABE976ACFF02728F1044B5B708D7092DB749D158BA2

Function 00882035 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000006), ref: 0088204A

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: b3e68b48781ddcf73d7f01b040371560b87b9fe37736f5991e56b7eca6e05254
Instruction ID: 545c03e04b057b5357546305faa34bf29f226031b4ae8fbadfa1c68ee51fdd3f
Opcode Fuzzy Hash: b3e68b48781ddcf73d7f01b040371560b87b9fe37736f5991e56b7eca6e05254
Instruction Fuzzy Hash: 01E0177150010C7BEF202E49EC05EBA3B9EFB80764F008020FD1DD9160DB32D962EB50

Function 100042B0 Relevance: 43.8, APIs: 3, Strings: 22, Instructions: 87stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100042EB
wsprintfA.USER32 ref: 100043AE
lstrlen.KERNEL32(?,?,00000000,00000400,?,00000000,75B0A250,00000000), ref: 100043C0

Strings

t, xrefs: 1000437E
i, xrefs: 1000438D
l, xrefs: 10004379
\, xrefs: 10004383
\, xrefs: 10004347
C, xrefs: 1000434C
c, xrefs: 10004392
C, xrefs: 10004360
u, xrefs: 10004351
n, xrefs: 10004356
t, xrefs: 1000435B
t, xrefs: 1000436F
E, xrefs: 1000433D
M, xrefs: 10004342
o, xrefs: 10004374
\, xrefs: 1000439B
Y, xrefs: 10004333
T, xrefs: 10004338
o, xrefs: 10004365
n, xrefs: 1000436A
v, xrefs: 10004388
%, xrefs: 100043A0

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memsetlstrlenwsprintf
String ID: %$C$C$E$M$T$Y$\$\$\$c$i$l$n$n$o$o$t$t$t$u$v
API String ID: 3920701723-2259266472
Opcode ID: fc51423a54f20ba0cd1b383de45813308f1179013de3e2716c4e834ab73a54c8
Instruction ID: a46160f322702c2bd1028dd7a75798120cbe2231d1047d22e2e72d5a756cfe09
Opcode Fuzzy Hash: fc51423a54f20ba0cd1b383de45813308f1179013de3e2716c4e834ab73a54c8
Instruction Fuzzy Hash: 7441FE6110D3C0DEE352C768988479FBFE55FA6608F48194DF2D817283C6BA9618C77B

Function 00881740 Relevance: 42.2, APIs: 2, Strings: 26, Instructions: 164
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088226C: InterlockedExchange.KERNEL32(008B9FC0,?), ref: 00882295

lstrlenA.KERNEL32 ref: 0088189F
lstrlenA.KERNEL32(TTTTTTTTTTTTXUY1c2KCNkzuiqp/UP+lPmT6cJwajsRtwz5ueIbG4bodZR8qFqGmidY/9UJgTFKbZVMbmiZRW8hD/o8scHdywwbEMPShXQYKwBrKKzcrj21dsFcFl+rGjdpiYDzW5PW0uKnobCZ4L0P9C01QD6M6HhIa91a0JHWt9O4rWDpysqI1i0k5HSwxNckqt5NZCA49SjsoE5nQYz0Lz2T8JN2pwIenRTwNbJ6csBfi8InJh9ohPFUFuLLO4wmA,008B70E0,00000170,?,?,?,?,?), ref: 00881946

Strings

., xrefs: 0088188B
D, xrefs: 008818EE
L, xrefs: 0088177D
i, xrefs: 00881916
TTTTTTTTTTTTXUY1c2KCNkzuiqp/UP+lPmT6cJwajsRtwz5ueIbG4bodZR8qFqGmidY/9UJgTFKbZVMbmiZRW8hD/o8scHdywwbEMPShXQYKwBrKKzcrj21dsFcFl+rGjdpiYDzW5PW0uKnobCZ4L0P9C01QD6M6HhIa91a0JHWt9O4rWDpysqI1i0k5HSwxNckqt5NZCA49SjsoE5nQYz0Lz2T8JN2pwIenRTwNbJ6csBfi8InJh9ohPFUFuLLO4wmA, xrefs: 00881941, 0088194D
., xrefs: 00881796
o, xrefs: 0088191B
LTY 1.0, xrefs: 0088176C
., xrefs: 00881890
., xrefs: 00881895
s, xrefs: 00881863
b, xrefs: 00881868
0, xrefs: 0088179B
T, xrefs: 00881782
I, xrefs: 008818F8
3, xrefs: 0088186D
S, xrefs: 00881881
_, xrefs: 008818F3
6, xrefs: 00881872
D, xrefs: 00881886
_, xrefs: 0088187C
, xrefs: 0088178C
s, xrefs: 00881901
0, xrefs: 00881877
1, xrefs: 00881791
Y, xrefs: 00881787

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$ExchangeInterlocked
String ID: $.$.$.$.$0$0$1$3$6$D$D$I$L$LTY 1.0$S$T$TTTTTTTTTTTTXUY1c2KCNkzuiqp/UP+lPmT6cJwajsRtwz5ueIbG4bodZR8qFqGmidY/9UJgTFKbZVMbmiZRW8hD/o8scHdywwbEMPShXQYKwBrKKzcrj21dsFcFl+rGjdpiYDzW5PW0uKnobCZ4L0P9C01QD6M6HhIa91a0JHWt9O4rWDpysqI1i0k5HSwxNckqt5NZCA49SjsoE5nQYz0Lz2T8JN2pwIenRTwNbJ6csBfi8InJh9ohPFUFuLLO4wmA$Y$_$_$b$i$o$s$s
API String ID: 1199788857-709353657
Opcode ID: b2e784a329565311a84f9b99f2cc5422cf838a4741ffc17182e790ec40376088
Instruction ID: 3dda335ae903c807c77e8b5ae3eb17a163771aa23466c8a60601cbe37570bb3a
Opcode Fuzzy Hash: b2e784a329565311a84f9b99f2cc5422cf838a4741ffc17182e790ec40376088
Instruction Fuzzy Hash: 8C618B7050C3C19ED711EB28884479BBFE5AFA6348F08495DF4C897342D6BAC609CBA7

Function 008824BE Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 158
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 008824C8
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,0088278F,?,?), ref: 008824F8
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 0088250C
ConvertDefaultLocale.KERNELBASE(?), ref: 00882548
ConvertDefaultLocale.KERNELBASE(?), ref: 00882556
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 00882573
ConvertDefaultLocale.KERNEL32(?), ref: 0088259E
ConvertDefaultLocale.KERNEL32(000003FF), ref: 008825A7
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 008825C0
EnumResourceLanguagesA.KERNEL32(00000000,00000010,00000001,Function_00001A5E,?), ref: 008825DD
ConvertDefaultLocale.KERNEL32(?), ref: 00882610
ConvertDefaultLocale.KERNEL32(00000000), ref: 00882619
GetModuleFileNameA.KERNEL32(00880000,?,00000105), ref: 0088265C
_memset.LIBCMT ref: 0088267C

Strings

GetUserDefaultUILanguage, xrefs: 00882500
ntdll.dll, xrefs: 008825BB
GetSystemDefaultUILanguage, xrefs: 00882558
kernel32.dll, xrefs: 008824E1
p,t, xrefs: 00882518, 008825F3

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll$p,t
API String ID: 3537336938-1723308960
Opcode ID: f13ef9e5b9754ec62ff06df2e995fa0f481af16adb8dc2bcffe66c227756d3e4
Instruction ID: 16ed9737bf9f20892025c4e926786c99b53e151eb98fc23382c23253ecb7cc08
Opcode Fuzzy Hash: f13ef9e5b9754ec62ff06df2e995fa0f481af16adb8dc2bcffe66c227756d3e4
Instruction Fuzzy Hash: 36513BB1D002289BDB65EF65CC45BEDBAB4FB59300F1401EAE548E3280EB749E81CF90

Function 0088EAB7 Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0088EB02
__mtinit.LIBCMT ref: 0088EB08
_fast_error_exit.LIBCMT ref: 0088EB13
__RTC_Initialize.LIBCMT ref: 0088EB19
__ioinit.LIBCMT ref: 0088EB21
__amsg_exit.LIBCMT ref: 0088EB2C
GetCommandLineA.KERNEL32 ref: 0088EB32
___crtGetEnvironmentStringsA.LIBCMT ref: 0088EB3D
__setargv.LIBCMT ref: 0088EB47
__amsg_exit.LIBCMT ref: 0088EB52
__setenvp.LIBCMT ref: 0088EB58
__amsg_exit.LIBCMT ref: 0088EB63
__cinit.LIBCMT ref: 0088EB6A
__amsg_exit.LIBCMT ref: 0088EB75
__wincmdln.LIBCMT ref: 0088EB7B

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: 253788bba735c08d51360628ba55e8c537b05ce8aa6c50c7fcb35f49d3a55695
Instruction ID: f632617d6ff2f84690a4781ce7006fe00443e88e5a53bd22a41e16e241cf3993
Opcode Fuzzy Hash: 253788bba735c08d51360628ba55e8c537b05ce8aa6c50c7fcb35f49d3a55695
Instruction Fuzzy Hash: DB2198749407199EDF647BB9DC86B7E32A4FF10B25F14042AF502FA183EBB4C9449B52

Function 0088C2D7 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0088C314
PathFindExtensionA.KERNELBASE(?), ref: 0088C32E
__strdup.LIBCMT ref: 0088C376
__strdup.LIBCMT ref: 0088C3B5
__strdup.LIBCMT ref: 0088C3FC
_strcat_s.LIBCMT ref: 0088C429
__strdup.LIBCMT ref: 0088C43B

Strings

.HLP, xrefs: 0088C3E1
.CHM, xrefs: 0088C3DA
.INI, xrefs: 0088C41C

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __strdup$ExtensionFileFindModuleNamePath_strcat_s
String ID: .CHM$.HLP$.INI
API String ID: 1153805871-4017452060
Opcode ID: 9d54ddf859d491bebb129aed26147f0ba9d4df98eeea6006390a790fba21541a
Instruction ID: 9aa230c386de085480793958516de694ebe0121b2c476deec13e5c78bffa2e62
Opcode Fuzzy Hash: 9d54ddf859d491bebb129aed26147f0ba9d4df98eeea6006390a790fba21541a
Instruction Fuzzy Hash: 29415CB19007099BDB21FB79CC45B9AB7ECFF04310F0049AAE555D2641EB74EA85CB61

Function 0088611D Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000,?,00886573,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00886130
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,00000000,00000000,?,00886573,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00886186
GlobalHandle.KERNEL32(?), ref: 0088618F
GlobalUnlock.KERNEL32(00000000), ref: 00886199
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 008861B2
GlobalHandle.KERNEL32(?), ref: 008861C4
GlobalLock.KERNEL32(00000000), ref: 008861CB
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,?,00886573,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 008861D4
GlobalLock.KERNEL32(00000000), ref: 008861E0
_memset.LIBCMT ref: 008861FA
LeaveCriticalSection.KERNEL32(?), ref: 00886228

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: e63264ba94904171afc0bb3f9532973ce26d044d070da085bf404f4495b35137
Instruction ID: 49679f3cee260fc072957304603c951ac43c128cd975c74e9d637c826d80a5d9
Opcode Fuzzy Hash: e63264ba94904171afc0bb3f9532973ce26d044d070da085bf404f4495b35137
Instruction Fuzzy Hash: 7C319E75600705AFE721AF68DC89A5ABBF9FF45700B05892AE552D3A52EB30F9118F10

Function 0088BBF2 Relevance: 12.0, APIs: 8, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 0088BC01
GetSystemMetrics.USER32(0000000C), ref: 0088BC08
GetSystemMetrics.USER32(00000002), ref: 0088BC0F
GetSystemMetrics.USER32(00000003), ref: 0088BC19
GetDC.USER32(00000000), ref: 0088BC23
GetDeviceCaps.GDI32(00000000,00000058), ref: 0088BC34
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0088BC3C
ReleaseDC.USER32(00000000,00000000), ref: 0088BC44

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: 43a05a868784b9c71f5d6c472a1f0c54c98608ab2d3987cd90494a05d0685763
Instruction ID: f8e683820140a8b66ec9dd67674321e49a8c348b2d729b01685d574d270d6253
Opcode Fuzzy Hash: 43a05a868784b9c71f5d6c472a1f0c54c98608ab2d3987cd90494a05d0685763
Instruction Fuzzy Hash: 8BF017B1E40718BBEB105B729C8DB167F68FB85762F004526E7159B6C0DAB598118FD0

Function 0088C45D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000), ref: 0088C46B
SetErrorMode.KERNELBASE(00000000), ref: 0088C473

Part of subcall function 00884C2F: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00884C67
Part of subcall function 00884C2F: SetLastError.KERNEL32(0000006F), ref: 00884C7E

GetModuleHandleA.KERNEL32(user32.dll), ref: 0088C4C2
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 0088C4D2

Part of subcall function 0088C2D7: GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0088C314
Part of subcall function 0088C2D7: PathFindExtensionA.KERNELBASE(?), ref: 0088C32E
Part of subcall function 0088C2D7: __strdup.LIBCMT ref: 0088C376
Part of subcall function 0088C2D7: __strdup.LIBCMT ref: 0088C3B5
Part of subcall function 0088C2D7: __strdup.LIBCMT ref: 0088C3FC

Strings

NotifyWinEvent, xrefs: 0088C4CC
user32.dll, xrefs: 0088C4BD

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ErrorModule__strdup$FileModeName$AddressExtensionFindHandleLastPathProc
String ID: NotifyWinEvent$user32.dll
API String ID: 621541537-597752486
Opcode ID: 85f7ae2bfb2d83c94620bed83f9a48da81dd0f590f46a32244ad2202c0ade0bc
Instruction ID: 227b9032cac33064dfae5d3ad09006e81cc1e0c93e20d1675bafbf0777957751
Opcode Fuzzy Hash: 85f7ae2bfb2d83c94620bed83f9a48da81dd0f590f46a32244ad2202c0ade0bc
Instruction Fuzzy Hash: 2401DFB0A402185FDB20FF68A809A593B98FF05711F05406AF519C7352DB78C8408FBA

Function 00881310 Relevance: 7.6, APIs: 6, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22ac1208eadabc9c6e13c7cf072684a39781f8f3794302ea239d6d918646ee6
Instruction ID: 688a77f90b432e49e218d77099c976ce8ee46d2752c9d7a4035b5ea4005b340d
Opcode Fuzzy Hash: e22ac1208eadabc9c6e13c7cf072684a39781f8f3794302ea239d6d918646ee6
Instruction Fuzzy Hash: 853192712003006BEB21EF68DC89F6B77ADFF88754F144119FA08D7681EB74E8418B55

Function 008811F0 Relevance: 7.6, APIs: 5, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0088121B
LoadLibraryA.KERNELBASE(?,?,00000014), ref: 0088123E
_realloc.LIBCMT ref: 0088125D

Part of subcall function 0088E606: _malloc.LIBCMT ref: 0088E61C

GetProcAddress.KERNEL32(00000000,?), ref: 008812A2
IsBadReadPtr.KERNEL32(?,00000014), ref: 008812C9

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Read$AddressLibraryLoadProc_malloc_realloc
String ID:
API String ID: 3858321205-0
Opcode ID: bcbfd14dc40586c30336cf91defbfd84d29fe4835554bae29b8440cb6e6d27b1
Instruction ID: 7392cea1716d43c8d82388a80ab948322618e42e3a8ec6543627cd6abafdce45
Opcode Fuzzy Hash: bcbfd14dc40586c30336cf91defbfd84d29fe4835554bae29b8440cb6e6d27b1
Instruction Fuzzy Hash: 5831BEB27002069FEB20DF69DC88A26F3A8FF44365F15062AE815D7651DB31E816CBE4

Function 008865E2 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE(?,?,?,00886648), ref: 0088660A
GlobalHandle.KERNEL32(?), ref: 00886618
GlobalUnlock.KERNEL32(00000000), ref: 00886621
GlobalFree.KERNEL32(00000000), ref: 00886628
DeleteCriticalSection.KERNEL32(?,?,?,00886648), ref: 00886632

Part of subcall function 0088642C: EnterCriticalSection.KERNEL32(?), ref: 0088648B
Part of subcall function 0088642C: LeaveCriticalSection.KERNEL32(?), ref: 0088649B
Part of subcall function 0088642C: LocalFree.KERNEL32(?), ref: 008864A4
Part of subcall function 0088642C: TlsSetValue.KERNEL32(?,00000000), ref: 008864B6

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: ebb413c3b1649913dd821edb0a30462a429aa8beb0adb41abe11177adc8a3ce7
Instruction ID: bb3ef1d4e706a5538e03397dabbc953421dd967183728b1780b7c59d56dfae95
Opcode Fuzzy Hash: ebb413c3b1649913dd821edb0a30462a429aa8beb0adb41abe11177adc8a3ce7
Instruction Fuzzy Hash: 98F0E2322002005BD721AB7CAC0CEAB37A9FF86760B190518F445D3351EF30EC168B24

Function 008814F0 Relevance: 6.1, APIs: 4, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,00000000,00881423), ref: 0088153F
VirtualFree.KERNELBASE(?,00000000,00008000,00881423), ref: 00881564
GetProcessHeap.KERNEL32(00000000,00000000,00881423), ref: 0088156D
HeapFree.KERNEL32(00000000), ref: 00881574

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtual
String ID:
API String ID: 548792435-0
Opcode ID: 38b9b22af0a6284195e36c0216c595ea50895faf9fa6ac5576e5543fe49f5659
Instruction ID: a70ab9c4207816bb091a14d5db05d8737692c950d44345550bbeab4fda41ea27
Opcode Fuzzy Hash: 38b9b22af0a6284195e36c0216c595ea50895faf9fa6ac5576e5543fe49f5659
Instruction Fuzzy Hash: 47113971640701ABEB31AF69DC8CB56B3A8FB85711F248918E1ABC7990DB74F842CB50

Function 00884C2F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00884B33: GetModuleHandleA.KERNEL32(KERNEL32,00884C4D), ref: 00884B41
Part of subcall function 00884B33: GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 00884B62
Part of subcall function 00884B33: GetProcAddress.KERNEL32(ReleaseActCtx), ref: 00884B74
Part of subcall function 00884B33: GetProcAddress.KERNEL32(ActivateActCtx), ref: 00884B86
Part of subcall function 00884B33: GetProcAddress.KERNEL32(DeactivateActCtx), ref: 00884B98

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00884C67
SetLastError.KERNEL32(0000006F), ref: 00884C7E

Strings

, xrefs: 00884C9C

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AddressProc$Module$ErrorFileHandleLastName
String ID:
API String ID: 2524245154-3916222277
Opcode ID: 77d6d42e3f018be678615ce8fe68ad4856e10992d6bb38c9a328a9401fb561d3
Instruction ID: f34dfd9b5eb66bd61932f159c1554b76081a6e5320d65d91cde9426b3097e501
Opcode Fuzzy Hash: 77d6d42e3f018be678615ce8fe68ad4856e10992d6bb38c9a328a9401fb561d3
Instruction Fuzzy Hash: A82181718012199EDB60EFB4D8497EEB7F8FF04324F10469ED459D2180DBB49A85DF51

Function 0088272D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00882755
PathFindExtensionA.SHLWAPI(?), ref: 0088276B

Part of subcall function 008824BE: __EH_prolog3_GS.LIBCMT ref: 008824C8
Part of subcall function 008824BE: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,0088278F,?,?), ref: 008824F8
Part of subcall function 008824BE: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 0088250C
Part of subcall function 008824BE: ConvertDefaultLocale.KERNELBASE(?), ref: 00882548
Part of subcall function 008824BE: ConvertDefaultLocale.KERNELBASE(?), ref: 00882556
Part of subcall function 008824BE: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 00882573
Part of subcall function 008824BE: ConvertDefaultLocale.KERNEL32(?), ref: 0088259E
Part of subcall function 008824BE: ConvertDefaultLocale.KERNEL32(000003FF), ref: 008825A7
Part of subcall function 008824BE: GetModuleFileNameA.KERNEL32(00880000,?,00000105), ref: 0088265C

Strings

%s%s.dll, xrefs: 00882774

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: e90f4d0be9fa1a55288ec030992d3f8a53e63526ca0fbe9006c395ff80792c97
Instruction ID: d480c47895c9e849894b2bdaa277451c4ac7fde3cd7c94c39ca6da114095dfa2
Opcode Fuzzy Hash: e90f4d0be9fa1a55288ec030992d3f8a53e63526ca0fbe9006c395ff80792c97
Instruction Fuzzy Hash: 6F018171A002189BDB14FB68DD45AEFB7E8FB45700F0400A5E505E7140EA749E048B71

Function 10003FD0 Relevance: 4.6, APIs: 3, Instructions: 97registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10004047
RegOpenKeyExA.KERNELBASE(?,?,00000000,00020019,?,10019390,?,?,?,?,?,00000000,Function_00006140,10013FE0,000000FE), ref: 10004066
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?,?,?,?,00000000,Function_00006140,10013FE0,000000FE), ref: 100040B1

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: OpenQueryValue_memset
String ID:
API String ID: 4181845570-0
Opcode ID: d9ddd5fe1c6d4b71ad2c49570aeaaceb52d95c6e63b1a26ff415b29271649183
Instruction ID: 397a07ba9fdae02477def609a9edf210321e93d1555123181cbf316d359f5299
Opcode Fuzzy Hash: d9ddd5fe1c6d4b71ad2c49570aeaaceb52d95c6e63b1a26ff415b29271649183
Instruction Fuzzy Hash: C83164F590024D9FEB20CF94CC40BEE77B8FB48754F108129EB15AB281DB75AA45CB68

Function 00881BBC Relevance: 4.6, APIs: 3, Instructions: 70
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,008A8008,00000000,00000001,?), ref: 00881C01
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 00881C21
RegCloseKey.ADVAPI32(?), ref: 00881C65

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8980f6dcc50ef47ca48433b699295d57a1f4988f765c527269a95a23ea615b52
Instruction ID: ef76d88fa79a840d6f35197fada7ed4ccbda9a60d51640581ca598d81287d9cb
Opcode Fuzzy Hash: 8980f6dcc50ef47ca48433b699295d57a1f4988f765c527269a95a23ea615b52
Instruction Fuzzy Hash: 37214971D40208EFDF14DF89C888AAEFBB9FF91305F2040AAE446E6210DB715A45CF61

Function 00881000 Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00881052
_memset.LIBCMT ref: 0088105B
VirtualAlloc.KERNELBASE(?,?,00001000,00000004), ref: 00881070

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AllocVirtual$_memset
String ID:
API String ID: 1876456587-0
Opcode ID: b1ea6a682bb7358eeb97c2e43a44d1d4301d74fe06b3b88824dc128b28c5b35b
Instruction ID: 09b46d1654dce9dde5168b9be4e5b06e78367594f7b04b662b962ab0206f29fd
Opcode Fuzzy Hash: b1ea6a682bb7358eeb97c2e43a44d1d4301d74fe06b3b88824dc128b28c5b35b
Instruction Fuzzy Hash: 741147B1604341AFE724DF09CC84F2AB3E9FF88754F15881DF6858B351CA71E8828B61

Function 100227C9 Relevance: 3.1, APIs: 2, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,00000000), ref: 10022867
VirtualProtect.KERNELBASE(?,00001000), ref: 1002287C

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4f36cc543f5f45c08a7db0548589c95f45be62c4509670af3a6f550c06d27b7d
Instruction ID: 44c01dd3d27f53d5454b4e9024d00421f68f2d310bbcfde34b9d0d8a4b0a1b3f
Opcode Fuzzy Hash: 4f36cc543f5f45c08a7db0548589c95f45be62c4509670af3a6f550c06d27b7d
Instruction Fuzzy Hash: B4216E72108246BFE321C7B4DC40BB6B7E8EB45394FA10425E899CB282DF60EC17D761

Function 008810B0 Relevance: 3.1, APIs: 2, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 008810FF
VirtualProtect.KERNELBASE(?,?,?,?), ref: 00881147

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 64ace54e8cb49935e897486a941fc8fd9e0f33100ccc65df7d8b4e069f182212
Instruction ID: 0ce91cc8b7fbad48985392c2b3d0d23321a517d99bfd5c1a8b89e3b743442345
Opcode Fuzzy Hash: 64ace54e8cb49935e897486a941fc8fd9e0f33100ccc65df7d8b4e069f182212
Instruction Fuzzy Hash: EC21B7756002068BDF18DF45D8CCE76B3AAFB98745F14424CEA06CB655DB30EC52C760

Function 00883996 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008839A9
SetWindowsHookExA.USER32(000000FF,Function_000037FE,00000000,00000000), ref: 008839B9

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 38a0200b011e95ecd5b2af30f37fa8e13a6b1943ee42b7cc1b394e640822f8e1
Instruction ID: 8d54cf990d9147fe494defb68f998df48f3fa42fd0cd4f7ef761c8a62b1792e8
Opcode Fuzzy Hash: 38a0200b011e95ecd5b2af30f37fa8e13a6b1943ee42b7cc1b394e640822f8e1
Instruction Fuzzy Hash: 6BD0A7B14043142EEB607774BC09B493E44FB03730F040244F421D15D1D66485414B96

Function 10004279 Relevance: 3.0, APIs: 2, Instructions: 11registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,10004262,04B08C62), ref: 10004281
RegCloseKey.ADVAPI32(04B08C62,10004262,04B08C62), ref: 1000428F

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ac686b4f780081cf1bc9312daa056d8dd8311a71cae3fa77a6afb895c132f166
Instruction ID: 9b6096f4f338bd6b4fb10cd01a9fdd8d56caf0c49b719ee1d411630276e9a8de
Opcode Fuzzy Hash: ac686b4f780081cf1bc9312daa056d8dd8311a71cae3fa77a6afb895c132f166
Instruction Fuzzy Hash: BEC012F0700200ABEF41CF20CC8CE6A37ACBB082C0B028244F808D2000DE34C980CA20

Function 0088F29D Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 0088F2A5

Part of subcall function 0088F272: GetModuleHandleW.KERNEL32(mscoree.dll,?,0088F2AA,?,?,0088EC98,000000FF,0000001E,?,00893643,?,00000001,?,?,00892192,00000018), ref: 0088F27C
Part of subcall function 0088F272: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0088F28C

ExitProcess.KERNEL32 ref: 0088F2AE

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: c7fd50bf89b969e3c52c532f9ebc4cf842b620627df3202e8b219c066859c63f
Instruction ID: 88aee18df6f8c9445ccf153d81fd46e19b4cc0450147a7b01d7cf31b6cbc0c3a
Opcode Fuzzy Hash: c7fd50bf89b969e3c52c532f9ebc4cf842b620627df3202e8b219c066859c63f
Instruction Fuzzy Hash: 71B09231000508BBDF013F6ADC0AC4A3F6AFB823A0B118020F90849072DF72AD929EA1

Function 00884EE9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00884EF0

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3f4352076a25d99225c1d6359a749e2ea2b472cd38d37827127934bb1f4ef4cf
Instruction ID: 60bb933a308e75ee3f099f8eaaa096ac03fbe806403b6a56d1cd16ef1adce465
Opcode Fuzzy Hash: 3f4352076a25d99225c1d6359a749e2ea2b472cd38d37827127934bb1f4ef4cf
Instruction Fuzzy Hash: B4212C35201B02DFDB19EF69C498A2AB7F5FF89711714565CF662CB6A1CB30E801DB11

Function 00886792 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00882035: FindResourceA.KERNEL32(?,?,00000006), ref: 0088204A

WideCharToMultiByte.KERNEL32(00000000,00000000,-00000002,?,00000001,?,00000000,00000000,?,?,00000000,?,008847B8,?,?,00000080), ref: 008867DB

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ByteCharFindMultiResourceWide
String ID:
API String ID: 3726879926-0
Opcode ID: cd719e25e6d908db9b97398bd6c981814eda023997ed666082e3053567035bf6
Instruction ID: 560b7c0be9e722587541eb6fe65b2f5bed5f8d1efa74e39e0fe6fc4ab2324173
Opcode Fuzzy Hash: cd719e25e6d908db9b97398bd6c981814eda023997ed666082e3053567035bf6
Instruction Fuzzy Hash: BBF0BEB31041997FA7207FAA9CC9CBB7B9CFA95768715042AF640CB101E522DC94C3B1

Function 0088651F Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00886526

Part of subcall function 008847FB: __CxxThrowException@8.LIBCMT ref: 00884811

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: 64b51a24904f61b19097dbef1a783cc380c17108da03e8c63207bc89852f84e3
Instruction ID: 2046bae028d6850e496beed9483c35692107080eb293e20e880cc646dc081033
Opcode Fuzzy Hash: 64b51a24904f61b19097dbef1a783cc380c17108da03e8c63207bc89852f84e3
Instruction Fuzzy Hash: 79017878600207CBDB25BF68E81A62936A2FF903A0B14153CE595DB291FF30CDA0CB16

Function 00881B2F Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078bcea8ded7f6e86bb2d86d51d634051be84e21345fa5cbd3e900538714b057
Instruction ID: fe17375c4a9145bda9b301d5d371a7f1ad7ac983ae0780120b08d24e03ebfaf6
Opcode Fuzzy Hash: 078bcea8ded7f6e86bb2d86d51d634051be84e21345fa5cbd3e900538714b057
Instruction Fuzzy Hash: EBE0D83200030597CF206D3898445E573CCFB62370F208326D071C31C0EB309883A754

Function 00885FEF Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 0088BA5A: LeaveCriticalSection.KERNEL32(?,?,00885FE5,00000010,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA75

__CxxThrowException@8.LIBCMT ref: 00885FFA

Part of subcall function 008914AC: RaiseException.KERNEL32(?,?,?,?), ref: 008914EE

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalExceptionException@8LeaveRaiseSectionThrow
String ID:
API String ID: 2386790472-0
Opcode ID: 09d1e922a7b403ebcc388d7e659541ec0f8879849bd1a604db80c9550a031faa
Instruction ID: 041c6a8614bbfc82695fcdb7b789e970f6091fc90f9e49dfe1a86068eb830f4a
Opcode Fuzzy Hash: 09d1e922a7b403ebcc388d7e659541ec0f8879849bd1a604db80c9550a031faa
Instruction Fuzzy Hash: 64E0C974B40209AFDB50EFA9D945F4977E5FF49708F240098A604EB391DAB1EE00DB15

Function 008819BA Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 008819D8

Part of subcall function 0088EC5F: __FF_MSGBANNER.LIBCMT ref: 0088EC82
Part of subcall function 0088EC5F: __NMSG_WRITE.LIBCMT ref: 0088EC89
Part of subcall function 0088EC5F: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00893643,?,00000001,?,?,00892192,00000018,008A5958,0000000C,00892223), ref: 0088ECD6

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: f8071fbb4b19d4578e3e53b6421e539ebaacaf6914b93e802ecd2c5b692b8aa3
Instruction ID: 12b0358561f93997382e3dca2617855d55965e0dbb104dac38ba253816ae42dd
Opcode Fuzzy Hash: f8071fbb4b19d4578e3e53b6421e539ebaacaf6914b93e802ecd2c5b692b8aa3
Instruction Fuzzy Hash: 4ED05E3270552A676F217ADAEC25AAA7F9EFB427B83540032F848DB551DF61CC1293D0

Function 0089223B Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00892250

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2c25939c5743726b4faa1e070c6b9d065ff1aca794f84e964b26598b2393a16b
Instruction ID: f46a589c0396232775428efe4856d75381b5acd481e0c9fc9481192b6036feb2
Opcode Fuzzy Hash: 2c25939c5743726b4faa1e070c6b9d065ff1aca794f84e964b26598b2393a16b
Instruction Fuzzy Hash: C8D0A732554309AEEB505FB57C48B263BDCF785795F144436F91CC6150F770D580CA00

Function 0088226C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(008B9FC0,?), ref: 00882295

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ExchangeInterlocked
String ID:
API String ID: 367298776-0
Opcode ID: 4191c7845f8ebd06adfbf3aa3c8a7c9994b3a69e38abca40796b92612dacc16d
Instruction ID: d51c050b073968a02ad6c89f697b70309f5eaaf230eb88406003c7abe00a830e
Opcode Fuzzy Hash: 4191c7845f8ebd06adfbf3aa3c8a7c9994b3a69e38abca40796b92612dacc16d
Instruction Fuzzy Hash: 8CE0EC75610A519FDB21BB78D80896AB7E5FF4D3117054869F5A6C3320DB31D801CB51

Function 10007865 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,100064D0,?), ref: 1000787A

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 15797bc0560bab309fbf6160860b827dd196f2af05f21e5587b21aaa6777ae17
Instruction ID: 3aeffb3154521fcd94c92435170d3f6785a63df5b8b874c5385d83aa7aee7d7f
Opcode Fuzzy Hash: 15797bc0560bab309fbf6160860b827dd196f2af05f21e5587b21aaa6777ae17
Instruction Fuzzy Hash: B9D05E729947596AF7009F715C88B223BDDE385695F10C436F91CC6160EA78D590C600

Function 0088665D Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

ctype.LIBCPMT ref: 00886679

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ctype
String ID:
API String ID: 3039457973-0
Opcode ID: d1ca52e0ae23d2e1f73f2c455c744adc4c952a9cb329e6b6d48d8d87d925d3e8
Instruction ID: 55e5b6e4d263ab6e7a005a8bc54d7798247f9b2ec099d2af2d5796a5aba3c464
Opcode Fuzzy Hash: d1ca52e0ae23d2e1f73f2c455c744adc4c952a9cb329e6b6d48d8d87d925d3e8
Instruction Fuzzy Hash: 90D08C34A1C3C60BEB75FB60A99DBB83751FBF072AF49117CC104D5992FA904824C309

Function 0088F4B9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 0088F4C5

Part of subcall function 0088F38D: __lock.LIBCMT ref: 0088F39B
Part of subcall function 0088F38D: __decode_pointer.LIBCMT ref: 0088F3D2
Part of subcall function 0088F38D: __decode_pointer.LIBCMT ref: 0088F3E7
Part of subcall function 0088F38D: __decode_pointer.LIBCMT ref: 0088F411
Part of subcall function 0088F38D: __decode_pointer.LIBCMT ref: 0088F427
Part of subcall function 0088F38D: __decode_pointer.LIBCMT ref: 0088F434
Part of subcall function 0088F38D: __initterm.LIBCMT ref: 0088F463
Part of subcall function 0088F38D: __initterm.LIBCMT ref: 0088F473

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: b8716ddc2b2c316f7e6a6179a100fa0205f6599af82a13803ab8f5ebe57424bd
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 90B0923258020833DA202946AC03F463A4997C0B64F240060BA0C196A2A9A2B961828A

Non-executed Functions

Function 10001C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll), ref: 10001C59
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10001C6B
FreeLibrary.KERNEL32(00000000), ref: 10001C90

Strings

RtlGetNtVersionNumbers, xrefs: 10001C65
ntdll.dll, xrefs: 10001C52

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 145871493-1263206204
Opcode ID: d711c6c5dd4a533c05bbbdab4e56c6e5b105c0ec9fb16935a3507c9fc672f45f
Instruction ID: 17b88f237ca996e660be609f40ce52b3cc88face2464b5a3678f627ee7a31a04
Opcode Fuzzy Hash: d711c6c5dd4a533c05bbbdab4e56c6e5b105c0ec9fb16935a3507c9fc672f45f
Instruction Fuzzy Hash: 9FE065BA2042216BA266DF218C48D9F77A6EFC87517028618F50497200DB30D825C7B2

Function 0088E5F7 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0089200A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0089201F
UnhandledExceptionFilter.KERNEL32(008A1E0C), ref: 0089202A
GetCurrentProcess.KERNEL32(C0000409), ref: 00892046
TerminateProcess.KERNEL32(00000000), ref: 0089204D

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b376674c3e8718871de735e3c8325c4d7b6577536d43f0446477d743f27d3333
Instruction ID: 4880386dab1e9714c233b3ba3451ea215f01c3a440a27d2ae9a8689939177a62
Opcode Fuzzy Hash: b376674c3e8718871de735e3c8325c4d7b6577536d43f0446477d743f27d3333
Instruction Fuzzy Hash: 7021C2B4841304DFDB51DF69E849A843BA4FB2A310F104259EA89C7761EB746980CF15

Function 100053BA Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000929F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100092B4
UnhandledExceptionFilter.KERNEL32(10012A1C), ref: 100092BF
GetCurrentProcess.KERNEL32(C0000409), ref: 100092DB
TerminateProcess.KERNEL32(00000000), ref: 100092E2

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 654fb14176351c92df5f980e551cd3ec5e19a6eab80db1a1405c862da9a16c67
Instruction ID: f14a19304f85b464b4b24906b0d8449a62d233daf6140d222a12ff5b46b69054
Opcode Fuzzy Hash: 654fb14176351c92df5f980e551cd3ec5e19a6eab80db1a1405c862da9a16c67
Instruction Fuzzy Hash: 74219EF58002249FE702DFA5C885A587BE4FB1A361F51812EE90886265E7B4D9C28F55

Function 10002840 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00000000,00000000,100029E4,00000000), ref: 1000288F
VirtualFree.KERNEL32(C0335B5E,00000000,00008000,00000000,100029E4,00000000), ref: 100028B4
GetProcessHeap.KERNEL32(00000000,100029E4,00000000,100029E4,00000000), ref: 100028BD
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,10003F45,?,?,00000040), ref: 100028C4

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtual
String ID:
API String ID: 548792435-0
Opcode ID: f59e60f9d6702d7f205f497bedf8067c0113e58a33076b6d2dd0c98a1b8e1350
Instruction ID: 61ca10426f2a71f51bacbd4b21daea2ef8cb34e6618af752df998f47c263c0f3
Opcode Fuzzy Hash: f59e60f9d6702d7f205f497bedf8067c0113e58a33076b6d2dd0c98a1b8e1350
Instruction Fuzzy Hash: 51117975601B119BE320CF65CC84F53B3E9FB88791F10CA28E59A97294CB74F881CB60

Function 008891F1 Relevance: 6.0, APIs: 4, Instructions: 42keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0088BA8D: GetWindowLongA.USER32(?,000000F0), ref: 0088BA98

GetKeyState.USER32(00000010), ref: 00889217
GetKeyState.USER32(00000011), ref: 00889220
GetKeyState.USER32(00000012), ref: 00889229
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 0088923F

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: bc073b0ea00c2ef1a5f35a3d55d9c4590caaa70795f5c3133efe17c08d77d389
Instruction ID: 211d6f966194eb7e1deecbb1721acb61b939a619c209924230adc8547607aae3
Opcode Fuzzy Hash: bc073b0ea00c2ef1a5f35a3d55d9c4590caaa70795f5c3133efe17c08d77d389
Instruction Fuzzy Hash: 18F0E9367C039A76EE2436789C05FB56815FF96BD5F080475F692EA1D1CFA0D8024771

Function 00886B5A Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abfc0ba7b4c883cf83c520ebc2d357db9f629c5722b2614fe763032bd397dc1
Instruction ID: 2923c657b7255f3bad19527973a2a95de28976ed2a5aa556e31d453cb6108d25
Opcode Fuzzy Hash: 7abfc0ba7b4c883cf83c520ebc2d357db9f629c5722b2614fe763032bd397dc1
Instruction Fuzzy Hash: 7EF0EC3160410DABDF027F65DD49EAE3F69FB00368F548424F916E5060FB30DA65EB51

Function 10004960 Relevance: 4.5, APIs: 3, Instructions: 38networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 1000499A
__WSAFDIsSet.WS2_32(?,00000000), ref: 100049AA
recv.WS2_32(?,?,?,?), ref: 100049CC

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: 1c47b4aea8ce01801d1e31e8b6946b46d948b6999eb620356d05c34384fcb141
Instruction ID: 0337ab474e6ceb0ddde879d859f2270736b801bd25fe8cc7b4f63dfc035d973a
Opcode Fuzzy Hash: 1c47b4aea8ce01801d1e31e8b6946b46d948b6999eb620356d05c34384fcb141
Instruction Fuzzy Hash: 74016DB1104315AFF310CF14C946BEB77E8EB89744F00891DF98882280E7B4A919CBE7

Function 10001CA0 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10001CB4
GetVersionExA.KERNEL32(?), ref: 10001CC3

Part of subcall function 10001C50: LoadLibraryW.KERNEL32(ntdll.dll), ref: 10001C59
Part of subcall function 10001C50: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10001C6B
Part of subcall function 10001C50: FreeLibrary.KERNEL32(00000000), ref: 10001C90

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Library$AddressFreeLoadProcVersion_memset
String ID:
API String ID: 2727220453-0
Opcode ID: 07caf2bc99cf999e3c917da996afbf08a64f0805bac80e91897df748069924a9
Instruction ID: 360d7321dabfcd0c9c216a73ad80702e05c655a7ce6568ab0cad9d29fd4f8aab
Opcode Fuzzy Hash: 07caf2bc99cf999e3c917da996afbf08a64f0805bac80e91897df748069924a9
Instruction Fuzzy Hash: 85F04F766003019BE314DF54E845D97B7EAEB88751F14882EF59A93241E670E408CB72

Function 10001D30 Relevance: 3.0, APIs: 2, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 10001D51
StartServiceCtrlDispatcherA.ADVAPI32(00000000), ref: 10001D5B

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: CtrlDispatcherServiceSleepStart
String ID:
API String ID: 1965773958-0
Opcode ID: 3a686218230e396f5769b4c60c2e5ad7b8e8e49d55a2721c6f62dfdb12b397bc
Instruction ID: c3c0789fb0aa49905dc1f89e3ebe7c304fb585c9465a02eb9bc80c4364c7ecb5
Opcode Fuzzy Hash: 3a686218230e396f5769b4c60c2e5ad7b8e8e49d55a2721c6f62dfdb12b397bc
Instruction Fuzzy Hash: FCD0E2B08483429BEB40EF68884955A7AE0FB84301F808D2DE4A9C2222E378C1298B42

Function 0088AA49 Relevance: 2.0, APIs: 1, Instructions: 452COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0088AA50

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 1ed5301d509b52a5625e502ea5c05550381072f5411c91ebd9de019eb28b8c94
Instruction ID: d40d048c2b1659aca0fc0f74770b0c9b768d52e8ffdb5d0a086e1a9dfe43a12e
Opcode Fuzzy Hash: 1ed5301d509b52a5625e502ea5c05550381072f5411c91ebd9de019eb28b8c94
Instruction Fuzzy Hash: 97F13A70504219EFEB18EF58C880ABE7BAAFF04314F50851AF916DB292DB35D911DB62

Function 00893AAA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00013A68), ref: 00893AAF

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 403ac884d1d5ac31e8e2d4c84cecc7f66313c020b900fd4297ddb65e8cf01d34
Instruction ID: d47a53266a93f450b368406ca77f93311abbd2ee437f179449041e9cdc1d75ef
Opcode Fuzzy Hash: 403ac884d1d5ac31e8e2d4c84cecc7f66313c020b900fd4297ddb65e8cf01d34
Instruction Fuzzy Hash: FE900260655A50569A0027785C0D60525E9BA8A71EB4544507051C4554DA9447009E13

Function 10002B00 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd16d0837e3175c8f4e9a4631b36355c66603bdb0b2986eb9f4cc6b256079d2b
Instruction ID: ab3db4970914f6caa84826317c03ee31de92541c5c01d244be012ba6039e3bbf
Opcode Fuzzy Hash: dd16d0837e3175c8f4e9a4631b36355c66603bdb0b2986eb9f4cc6b256079d2b
Instruction Fuzzy Hash: C512C4BBB983194FDB48CEE5DCC169573E1FB98304F09A43C9A55C7306F6E8AA094790

Function 00890CF8 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 9fb258cee978e671336042118db2ab1e263d78908c63b64d29524c37591a4b40
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: C9D16C73D0E9F30A8B35912D446823AEA62BFD1B4132EC7E1DCD47F38A96675D40A9D0

Function 008908D8 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 2cdf8391e66453a43eb5c13ce85e70a10bac1c6aad09f21a870144bacc6e528e
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 2BD17E73C0EAB30E8B35912D446826AEEA2BFD175531EC3E19CE47F38AD1275D4099D0

Function 008904CC Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: dd611b5c32013a3ef84b4408059043e63c2efcf2e8e9ee91212606be6e1da6b8
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 14C18E73D0E9B30E8B36912D446867AEA62BFD175031FC3E19CD47F38A92675D40AAD0

Function 008900F8 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 4f44b75272a9224bb3d3328faa9b98aa47e070b065da8c2446c73c0b9ee4e919
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: E7C18073D0E9B30E8B36912D456827AEE62BFD174431EC3E19CE46F38AD2275D44A9D0

Function 10004400 Relevance: 43.8, APIs: 3, Strings: 22, Instructions: 90COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000443A
_memset.LIBCMT ref: 1000444B
wsprintfA.USER32 ref: 1000450E

Part of subcall function 10003FD0: _memset.LIBCMT ref: 10004047
Part of subcall function 10003FD0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00020019,?,10019390,?,?,?,?,?,00000000,Function_00006140,10013FE0,000000FE), ref: 10004066

Strings

t, xrefs: 100044CF
\, xrefs: 100044E7
v, xrefs: 100044F0
T, xrefs: 10004490
i, xrefs: 100044F5
t, xrefs: 100044E2
n, xrefs: 100044B6
o, xrefs: 100044D8
\, xrefs: 1000449F
n, xrefs: 100044CA
c, xrefs: 100044FA
Y, xrefs: 1000448B
M, xrefs: 1000449A
l, xrefs: 100044DD
C, xrefs: 100044A4
\, xrefs: 100044FF
u, xrefs: 100044A9
C, xrefs: 100044C0
o, xrefs: 100044C5
E, xrefs: 10004495
%, xrefs: 10004504
t, xrefs: 100044BB

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memset$Openwsprintf
String ID: %$C$C$E$M$T$Y$\$\$\$c$i$l$n$n$o$o$t$t$t$u$v
API String ID: 2563797908-2259266472
Opcode ID: adb3be5b4f37fc057afd18636047961455c28565628c32ca6af17fa1ab4919a4
Instruction ID: 86c0efe4c7f522963cac631f70758111c67d48b8954de0a18f7ff0608c6add87
Opcode Fuzzy Hash: adb3be5b4f37fc057afd18636047961455c28565628c32ca6af17fa1ab4919a4
Instruction Fuzzy Hash: 6441EA6110D3C0DDE362C6689885B9FBFE55BE7644F48588DF2C40B282C6FA9548C777

Function 10003D30 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 164stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10001690: CreateEventA.KERNEL32(00000000,00000000,00000000), ref: 1000169E
Part of subcall function 10001690: GetLastError.KERNEL32 ref: 100016AA
Part of subcall function 10001690: CloseHandle.KERNEL32(00000000), ref: 100016C4

lstrlen.KERNEL32(T2410122238-0F8BFBFF000806F8), ref: 10003D82
lstrlen.KERNEL32(K230715080808P01234567), ref: 10003D8D
_memset.LIBCMT ref: 10003DB3
lstrlen.KERNEL32(T2410122238-0F8BFBFF000806F8), ref: 10003DC0
lstrlen.KERNEL32(T2410122238-0F8BFBFF000806F8), ref: 10003DE1
_memset.LIBCMT ref: 10003E27
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10003E3A
_memset.LIBCMT ref: 10003E4E
_strrchr.LIBCMT ref: 10003E5A
lstrlen.KERNEL32(00000001), ref: 10003E66
lstrlen.KERNEL32(00000001), ref: 10003E90
PathRemoveFileSpecA.SHLWAPI(?), ref: 10003E9B

Part of subcall function 100034C0: OpenProcess.KERNEL32(00000040,00000000,00000000,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 100034DB

Strings

\, xrefs: 10003EE1
C:\Windows\SystemNvwmiShell\NvwmiShell.exe, xrefs: 10003D6B
\, xrefs: 10003EDC
d, xrefs: 10003EEB
K230715080808P01234567, xrefs: 10003D88, 10003D90
T2410122238-0F8BFBFF000806F8, xrefs: 10003D7D, 10003D95, 10003DBB, 10003DCE, 10003DDC
., xrefs: 10003EE6

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$_memset$File$CloseCreateErrorEventHandleLastModuleNameOpenPathProcessRemoveSpec_strrchr
String ID: .$C:\Windows\SystemNvwmiShell\NvwmiShell.exe$K230715080808P01234567$T2410122238-0F8BFBFF000806F8$\$\$d
API String ID: 2330158667-3616349848
Opcode ID: 1bf932c77ce2cdef0302630ebebd45fa1d73652634778ed7e2123af945d6a7ce
Instruction ID: ca23d12d9f6e500521e3c6517e95297770f1958da5c4c01a7c7bc343bf0d7a5a
Opcode Fuzzy Hash: 1bf932c77ce2cdef0302630ebebd45fa1d73652634778ed7e2123af945d6a7ce
Instruction Fuzzy Hash: 7851F971108341AFE311DBA4CC85FAB7BE8EF99284F04851DF69857242D770E688C7A6

Function 100017C0 Relevance: 36.8, APIs: 4, Strings: 17, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 1000186B
GetProcAddress.KERNEL32(00000000), ref: 10001872
GetCurrentProcess.KERNEL32 ref: 10001885
IsWow64Process.KERNEL32(00000000), ref: 1000188C

Strings

N, xrefs: 10001816
., xrefs: 1000182A
I, xrefs: 10001839
P, xrefs: 10001852
K, xrefs: 1000180C
R, xrefs: 10001811
w, xrefs: 10001843
2, xrefs: 10001825
r, xrefs: 10001857
4, xrefs: 1000184D
W, xrefs: 1000183E
c, xrefs: 1000185C
6, xrefs: 10001848
L, xrefs: 1000181B
d, xrefs: 1000182F
e, xrefs: 10001861
3, xrefs: 10001820

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Process$AddressCurrentLibraryLoadProcWow64
String ID: .$2$3$4$6$I$K$L$N$P$R$W$c$d$e$r$w
API String ID: 4035193891-3529685913
Opcode ID: 10d9e8f6925ff5a1af6f0d48fce6c68cb2f32344a34a7f8091a55976ae343cac
Instruction ID: 702da095a0edb4efcb78b19583d3893ca75c456b827562c0f4978adbde2b3090
Opcode Fuzzy Hash: 10d9e8f6925ff5a1af6f0d48fce6c68cb2f32344a34a7f8091a55976ae343cac
Instruction Fuzzy Hash: 5121CB6100D3C1DEE302DB68844874BBFE55BAA648F088A8DF0C95B282D6B9C71CC777

Function 0088A63F Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0088A649

Part of subcall function 0088651F: __EH_prolog3.LIBCMT ref: 00886526

CallNextHookEx.USER32(?,?,?,?), ref: 0088A68D

Part of subcall function 008847FB: __CxxThrowException@8.LIBCMT ref: 00884811

GetClassLongA.USER32(?,000000E6), ref: 0088A6D1
GlobalGetAtomNameA.KERNEL32(?,?,?,?,?,?,00000005), ref: 0088A6FB
SetWindowLongA.USER32(?,000000FC,Function_0000951E), ref: 0088A750
_memset.LIBCMT ref: 0088A79A
GetClassLongA.USER32(?,000000E0), ref: 0088A7CA
GetClassNameA.USER32(?,?,00000100), ref: 0088A7EB
GetWindowLongA.USER32(?,000000FC), ref: 0088A80F
GetPropA.USER32(?,AfxOldWndProc423), ref: 0088A829
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 0088A834
GetPropA.USER32(?,AfxOldWndProc423), ref: 0088A83C
GlobalAddAtomA.KERNEL32(AfxOldWndProc423), ref: 0088A844
SetWindowLongA.USER32(?,000000FC,Function_0000A4F2), ref: 0088A852
CallNextHookEx.USER32(?,00000003,?,?), ref: 0088A86A
UnhookWindowsHookEx.USER32(?), ref: 0088A87E

Strings

#32768, xrefs: 0088A7AC, 0088A7B1, 0088A7FB
ime, xrefs: 0088A704
AfxOldWndProc423, xrefs: 0088A822, 0088A827, 0088A832, 0088A83A, 0088A843

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalNameNext$Exception@8H_prolog3H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 867647115-4034971020
Opcode ID: 2445360893ffd0213ae1e7927c3e1183a81ede697f41d3d7b642fe9a5df47e2c
Instruction ID: 23a78f2f65ab5a8b24dabbc43bd26efe5f482289a7df35c19144d2381dd76ee7
Opcode Fuzzy Hash: 2445360893ffd0213ae1e7927c3e1183a81ede697f41d3d7b642fe9a5df47e2c
Instruction Fuzzy Hash: 6D61D13180021AABEB25BB64CC49BAE7BB8FF05321F100166F655E25D1DB34CD81DFA2

Function 100014C0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 10001517
lstrlen.KERNEL32(00000001), ref: 1000151E
lstrlen.KERNEL32(?), ref: 10001529
lstrlen.KERNEL32(?), ref: 10001538
lstrlen.KERNEL32(?), ref: 10001547
lstrlen.KERNEL32(?), ref: 10001556
lstrlen.KERNEL32(?), ref: 10001565
lstrlen.KERNEL32(00000000), ref: 10001574
lstrlen.KERNEL32(00000001), ref: 10001585
lstrlen.KERNEL32(?), ref: 1000159A
_sprintf.LIBCMT ref: 100015BB
lstrlen.KERNEL32(?), ref: 100015CE
lstrlen.KERNEL32(?), ref: 100015E4
lstrlen.KERNEL32(?), ref: 10001600

Strings

Global\%s, xrefs: 100015B5

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$_sprintf
String ID: Global\%s
API String ID: 1646862159-1921477690
Opcode ID: 1c449f34d9e6914fdf01324ea40385997640dc46db10c9877e91c0418cabb1e7
Instruction ID: 0e3358286bf1c73d62acb18ad4d628da7ec24e660d7c29ea413a6a58d1b58574
Opcode Fuzzy Hash: 1c449f34d9e6914fdf01324ea40385997640dc46db10c9877e91c0418cabb1e7
Instruction Fuzzy Hash: 9C51C3B29042056FD310EF64CC81DABB7EDEFC8348F04491EF54997106DA75E605CBA2

Function 100035E0 Relevance: 30.2, APIs: 20, Instructions: 214stringfilesleepCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10003622

Part of subcall function 1000523F: __FF_MSGBANNER.LIBCMT ref: 10005262
Part of subcall function 1000523F: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001), ref: 100052B6

Part of subcall function 10001350: lstrlen.KERNEL32 ref: 100013A3

_memset.LIBCMT ref: 10003656
lstrlen.KERNEL32(00000000), ref: 1000366F
lstrlen.KERNEL32(00000001), ref: 10003676
lstrlen.KERNEL32(?), ref: 10003681
lstrlen.KERNEL32(?), ref: 10003690
lstrlen.KERNEL32(?), ref: 1000369F

Part of subcall function 10003310: wsprintfA.USER32 ref: 1000339C
Part of subcall function 10003310: wsprintfA.USER32 ref: 100033E4

_malloc.LIBCMT ref: 10003715
_memset.LIBCMT ref: 10003724
_memset.LIBCMT ref: 10003731
_memset.LIBCMT ref: 1000373E
_memset.LIBCMT ref: 10003751
lstrlen.KERNEL32(00000001), ref: 1000375A
lstrlen.KERNEL32(?), ref: 1000376C
lstrlen.KERNEL32(?), ref: 10003781
DeleteFileA.KERNEL32(?,00000000), ref: 100037C4
Sleep.KERNEL32(000000C8), ref: 100037CF
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 100037E5
WriteFile.KERNEL32 ref: 1000380A
CloseHandle.KERNEL32(00000000), ref: 10003811

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$_memset$File$_mallocwsprintf$AllocateCloseCreateDeleteHandleHeapSleepWrite
String ID:
API String ID: 1465790191-0
Opcode ID: d2f87e1ab22fe96f96345a49dda9cc71e6b4e657ab06946fb1e5cb0ea88aeb21
Instruction ID: 527a364bbca301f577077738ad255cdf674a1d0a573911f68b4a685805fc0f6c
Opcode Fuzzy Hash: d2f87e1ab22fe96f96345a49dda9cc71e6b4e657ab06946fb1e5cb0ea88aeb21
Instruction Fuzzy Hash: 74719EB5504344AFE320EF64CC85F5BB7EDEF88684F408A1CF58597246DA75FA088B62

Function 00886A12 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,75C04A40,00886B67,?,?,?,?,?,?,?,008889C9,00000000,00000002,00000028), ref: 00886A3D
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00886A59
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00886A6A
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00886A7B
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 00886A8C
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 00886A9D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00886AAE
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 00886ABF

Strings

GetSystemMetrics, xrefs: 00886A53
GetMonitorInfoA, xrefs: 00886AA8
EnumDisplayDevicesA, xrefs: 00886AB9
MonitorFromRect, xrefs: 00886A75
MonitorFromWindow, xrefs: 00886A64
USER32, xrefs: 00886A33
EnumDisplayMonitors, xrefs: 00886A97
MonitorFromPoint, xrefs: 00886A86

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: a1b448af80e342c839807d8b5d1264b540305bba9d14b413f065c524a63d359c
Instruction ID: 0c7e7ff8ad400cdc5429207056d79345cd8d38a2a87dacf6780bd1d253ec9f52
Opcode Fuzzy Hash: a1b448af80e342c839807d8b5d1264b540305bba9d14b413f065c524a63d359c
Instruction Fuzzy Hash: 1D214FB1954272AF8720BF786CC986A3BE9F24A7003148A7FD251F26A1E7790445AF51

Function 008888D9 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0088BA8D: GetWindowLongA.USER32(?,000000F0), ref: 0088BA98

GetParent.USER32(?), ref: 00888908
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 0088892B
GetWindowRect.USER32(?,?), ref: 00888945
GetWindowLongA.USER32(00000000,000000F0), ref: 0088895B
CopyRect.USER32(?,?), ref: 008889A8
CopyRect.USER32(?,?), ref: 008889B2
GetWindowRect.USER32(00000000,?), ref: 008889BB
CopyRect.USER32(?,?), ref: 008889D7

Strings

(, xrefs: 00888971

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: 3c94a82e3d2450fd9ad6df87dfea1a529c00956c7c2ef8231af2950f29490da2
Instruction ID: 6839759c11d4cf427db6b8fd3bf5a1cff934818ca7fbc498a4aed639a8293749
Opcode Fuzzy Hash: 3c94a82e3d2450fd9ad6df87dfea1a529c00956c7c2ef8231af2950f29490da2
Instruction Fuzzy Hash: 51513D72900219EBDB15EBA8CC89EEEBBB9FF48314F554115F905F7290EB30A9418B61

Function 10002290 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161filesleepCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,?,?,?,00000000), ref: 100022A4
Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 100022AF
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 100022CC
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,00000000), ref: 100022E8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000), ref: 10002308
CloseHandle.KERNEL32(00000000), ref: 1000230F
CreateFileA.KERNEL32 ref: 10002393

Strings

m, xrefs: 1000229D

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: File$Create$CloseDeleteHandleReadSizeSleep
String ID: m
API String ID: 1146365786-2771054989
Opcode ID: 929c178294106a363233bb4f4d782717d10050edf4adc5d20d1cdf64f0b6b01a
Instruction ID: 048fd775433e3bb0f5106af364adc211d506ff6b6e098e165c594137fc544903
Opcode Fuzzy Hash: 929c178294106a363233bb4f4d782717d10050edf4adc5d20d1cdf64f0b6b01a
Instruction Fuzzy Hash: 5F41D672500320AFE210DB64DC85F9B77E8EB8D751F004629FA05A7292DB75F919CBB2

Function 10004560 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 63stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10004582

Part of subcall function 10004400: _memset.LIBCMT ref: 1000443A
Part of subcall function 10004400: _memset.LIBCMT ref: 1000444B
Part of subcall function 10004400: wsprintfA.USER32 ref: 1000450E

lstrlen.KERNEL32(T2410122238-0F8BFBFF000806F8), ref: 100045E7

Part of subcall function 100011D0: _memset.LIBCMT ref: 100011F3
Part of subcall function 100011D0: __time64.LIBCMT ref: 100011FD
Part of subcall function 100011D0: __localtime64.LIBCMT ref: 10001214
Part of subcall function 100011D0: _memset.LIBCMT ref: 10001227
Part of subcall function 100011D0: _sprintf.LIBCMT ref: 1000125B
Part of subcall function 100011D0: _memset.LIBCMT ref: 10001269
Part of subcall function 100011D0: wsprintfA.USER32 ref: 10001296

Part of subcall function 100042B0: _memset.LIBCMT ref: 100042EB
Part of subcall function 100042B0: wsprintfA.USER32 ref: 100043AE
Part of subcall function 100042B0: lstrlen.KERNEL32(?,?,00000000,00000400,?,00000000,75B0A250,00000000), ref: 100043C0

Strings

y, xrefs: 100045AB
K, xrefs: 100045A6
G, xrefs: 100045BF
u, xrefs: 100045CE
p, xrefs: 100045D3
n, xrefs: 100045B0
t, xrefs: 100045BA
T2410122238-0F8BFBFF000806F8, xrefs: 1000457B, 10004599, 100045E2, 100045FD
o, xrefs: 100045C9
c, xrefs: 100045B5
r, xrefs: 100045C4

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memset$wsprintf$lstrlen$__localtime64__time64_sprintf
String ID: G$K$T2410122238-0F8BFBFF000806F8$c$n$o$p$r$t$u$y
API String ID: 3550073382-364563091
Opcode ID: 74c00d020acbef3582af209f9f2aa1f1ca7564db1ece04251ae4a75fbdc6b44e
Instruction ID: bb9a5fe94ae0ae072ababa0a8f05b0bda7bf95df23aab9b9d522deb1e55f3948
Opcode Fuzzy Hash: 74c00d020acbef3582af209f9f2aa1f1ca7564db1ece04251ae4a75fbdc6b44e
Instruction Fuzzy Hash: 7C21D16160C3C09AF305CB689C05B5FBBE59FE6644F04085DF1895A282C7BAE74883AB

Function 100018B0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 87sleepfilestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100018DC

Part of subcall function 10004400: _memset.LIBCMT ref: 1000443A
Part of subcall function 10004400: _memset.LIBCMT ref: 1000444B
Part of subcall function 10004400: wsprintfA.USER32 ref: 1000450E

lstrlen.KERNEL32(?), ref: 10001943
PathFileExistsA.SHLWAPI(00000044), ref: 10001959
Sleep.KERNEL32(000001F4), ref: 1000197A
DeleteFileA.KERNEL32(00000044), ref: 10001981
PathFileExistsA.SHLWAPI(00000044), ref: 10001989

Strings

s, xrefs: 1000192C
i, xrefs: 10001923
F, xrefs: 1000191E
t, xrefs: 10001915
D, xrefs: 10001908

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: File_memset$ExistsPath$DeleteSleeplstrlenwsprintf
String ID: D$F$i$s$t
API String ID: 3780081668-3907551925
Opcode ID: 3559ba0a86e11da85a83663f44138544efc67dcb359365154b660fe8d36b5c35
Instruction ID: a1631cf77f03373826da4636f993314f369d54a2a96ff2d850bd0d48caae8aa3
Opcode Fuzzy Hash: 3559ba0a86e11da85a83663f44138544efc67dcb359365154b660fe8d36b5c35
Instruction Fuzzy Hash: AD31A77210C3819FE311DB648880AAFBBE9AFD9688F444A1DF2C557242D674E708C76B

Function 100011D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100011F3
__time64.LIBCMT ref: 100011FD

Part of subcall function 1000516E: GetSystemTimeAsFileTime.KERNEL32(?), ref: 10005179
Part of subcall function 1000516E: __aulldiv.LIBCMT ref: 10005199

__localtime64.LIBCMT ref: 10001214

Part of subcall function 10005147: __gmtime64_s.LIBCMT ref: 1000515C

_memset.LIBCMT ref: 10001227
_sprintf.LIBCMT ref: 1000125B
_memset.LIBCMT ref: 10001269
wsprintfA.USER32 ref: 10001296

Strings

T2410122238-0F8BFBFF000806F8, xrefs: 100011EE, 1000129C, 100012C7, 100012E7, 1000130F
%08X%08X, xrefs: 10001290
%d%02d%02d%02d%02d, xrefs: 10001255

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memset$Time$FileSystem__aulldiv__gmtime64_s__localtime64__time64_sprintfwsprintf
String ID: %08X%08X$%d%02d%02d%02d%02d$T2410122238-0F8BFBFF000806F8
API String ID: 2159953709-4070902383
Opcode ID: b4955a9ce85e649393f663804a74e4a75c6b77984e787d9fb8229fb0411b1f69
Instruction ID: 2dcffaa277a8476455f2ef3be5a96e5623be1a3afd47c62e9a855ef38a6a4532
Opcode Fuzzy Hash: b4955a9ce85e649393f663804a74e4a75c6b77984e787d9fb8229fb0411b1f69
Instruction Fuzzy Hash: F84127751047425BE319CF64CC55BEBB3E6EFC4780F40461DF58A8B240E6B2E949C761

Function 00881A78 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 00881AA1
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 00881ABE
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 00881ACB
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 00881AD8
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 00881AE5

Strings

ActivateActCtx, xrefs: 00881ACD
DeactivateActCtx, xrefs: 00881ADA
ReleaseActCtx, xrefs: 00881AC0
CreateActCtxA, xrefs: 00881AB8
KERNEL32, xrefs: 00881A9C

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: baae7b531ec85e15763c3de775ef89f0a651bbc7f3b2a4b686363abdf15e5359
Instruction ID: 5e7f928d3c10cf19bb24dcca68a53d1aded7c413b3f186a3167957de784a33c4
Opcode Fuzzy Hash: baae7b531ec85e15763c3de775ef89f0a651bbc7f3b2a4b686363abdf15e5359
Instruction Fuzzy Hash: 67118F71D89314ABCF24BF65ECC881A7FA8FA96750311813FE104D3690EE744842CF55

Function 00884B33 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00884C4D), ref: 00884B41
GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 00884B62
GetProcAddress.KERNEL32(ReleaseActCtx), ref: 00884B74
GetProcAddress.KERNEL32(ActivateActCtx), ref: 00884B86
GetProcAddress.KERNEL32(DeactivateActCtx), ref: 00884B98

Part of subcall function 008847FB: __CxxThrowException@8.LIBCMT ref: 00884811

Strings

ActivateActCtx, xrefs: 00884B76
DeactivateActCtx, xrefs: 00884B88
ReleaseActCtx, xrefs: 00884B64
CreateActCtxW, xrefs: 00884B5C
KERNEL32, xrefs: 00884B3C

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AddressProc$Exception@8HandleModuleThrow
String ID: ActivateActCtx$CreateActCtxW$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 2144170044-2424895508
Opcode ID: f05436b2af25eadf966224b2258c2121977ab1db12e09c46b1f9fcdc7a9e3fe0
Instruction ID: aeadd84c0dec351a8b82f9766a8f360deff2d61b8e4f20f660ded7876eb52880
Opcode Fuzzy Hash: f05436b2af25eadf966224b2258c2121977ab1db12e09c46b1f9fcdc7a9e3fe0
Instruction Fuzzy Hash: B8F01271D4839A9FDB107FB0BC099053FA4F746721B002556A410F2760DFB89040DF58

Function 10004CC0 Relevance: 16.6, APIs: 11, Instructions: 98networksleepstringCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 10004CEA
socket.WS2_32(00000002,00000001,00000000), ref: 10004CF5
gethostbyname.WS2_32(?), ref: 10004D4B
inet_ntoa.WS2_32(?), ref: 10004D72
lstrcpy.KERNEL32(?,00000000), ref: 10004D81
inet_addr.WS2_32(?), ref: 10004D99
htons.WS2_32(?), ref: 10004DA8
connect.WS2_32(00000000,?,00000010), ref: 10004DBB
Sleep.KERNEL32(0000000A), ref: 10004DDC
closesocket.WS2_32(00000000), ref: 10004DF1
WSACleanup.WS2_32 ref: 10004DF7

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: CleanupSleepStartupclosesocketconnectgethostbynamehtonsinet_addrinet_ntoalstrcpysocket
String ID:
API String ID: 1497285988-0
Opcode ID: 6d092484236cac678b156c704b7443424f51758ab1aca10ca42d8706b32be310
Instruction ID: 382a9743452a4c04bc4d813f8a42904d5fa19f675ade579c32352dcd571608c9
Opcode Fuzzy Hash: 6d092484236cac678b156c704b7443424f51758ab1aca10ca42d8706b32be310
Instruction Fuzzy Hash: C1313EB1508350AFE324DF64D884EABB7E9EF88740F00891EF559C3251D770D918CB66

Function 100039D0 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 79sleepstringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,74DF0440,74DF0F00,?,?,?,?,?,10003F45,?,?,00000040), ref: 10003A82
Sleep.KERNEL32(000007D0,74DF0440,74DF0F00,?,?,?,?,?,10003F45,?,?,00000040), ref: 10003A9D

Strings

W, xrefs: 10003A3C
_, xrefs: 10003A37
m, xrefs: 10003A54
3, xrefs: 10003A59
D, xrefs: 10003A2A
a, xrefs: 10003A41
c, xrefs: 10003A4A
T2410122238-0F8BFBFF000806F8, xrefs: 10003A8E
o, xrefs: 10003A4F

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Sleeplstrlen
String ID: 3$D$T2410122238-0F8BFBFF000806F8$W$_$a$c$m$o
API String ID: 404571708-296707681
Opcode ID: cf60eaa935ea09993eb39032457f5dc8f9d1f92bbccc55d8e19afddbc1d30710
Instruction ID: c819195460774051f07f7f022d288dde7b32127f139733f69c84a74f793f67aa
Opcode Fuzzy Hash: cf60eaa935ea09993eb39032457f5dc8f9d1f92bbccc55d8e19afddbc1d30710
Instruction Fuzzy Hash: 0F21E3752083819FE311DB28C845B1BBBE99F95348F08890DF4D947282D779E64CCBA3

Function 10001D70 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 164sleepstringCOMMON

Download Yara Rule

APIs

Part of subcall function 10001CA0: _memset.LIBCMT ref: 10001CB4
Part of subcall function 10001CA0: GetVersionExA.KERNEL32(?), ref: 10001CC3

Part of subcall function 100017C0: LoadLibraryA.KERNEL32 ref: 1000186B
Part of subcall function 100017C0: GetProcAddress.KERNEL32(00000000), ref: 10001872
Part of subcall function 100017C0: GetCurrentProcess.KERNEL32 ref: 10001885
Part of subcall function 100017C0: IsWow64Process.KERNEL32(00000000), ref: 1000188C

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10001DC2
lstrlen.KERNEL32(?), ref: 10001DCF
Sleep.KERNEL32(00000001,?), ref: 10001E37
Sleep.KERNEL32(000003E8,?,?,00000000), ref: 10001EC5

Strings

F, xrefs: 10001F26
D, xrefs: 10001F1C
i, xrefs: 10001F2B
t, xrefs: 10001F21
s, xrefs: 10001F30

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: ProcessSleep$AddressCurrentFileLibraryLoadModuleNameProcVersionWow64_memsetlstrlen
String ID: D$F$i$s$t
API String ID: 1740255010-3907551925
Opcode ID: 1d0f5541d43d07943ac158e7c804ada25d0fe5b8d43bab013b6e5e15ff2c05dc
Instruction ID: 163e67f595c3a466306f0538099d8f6b6a82b4d5620d8888f04192d8a2c66a9d
Opcode Fuzzy Hash: 1d0f5541d43d07943ac158e7c804ada25d0fe5b8d43bab013b6e5e15ff2c05dc
Instruction Fuzzy Hash: 10512D752083C09BF305DB648841BAFB7D9DFC96C4F44490DF99687286DB61EB4883A3

Function 0088A4F2 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0088A4F9
GetPropA.USER32(?,AfxOldWndProc423), ref: 0088A508
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 0088A562

Part of subcall function 008893B5: GetWindowRect.USER32(?,10000000), ref: 008893DF

SetWindowLongA.USER32(?,000000FC,?), ref: 0088A589
RemovePropA.USER32(?,AfxOldWndProc423), ref: 0088A591
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 0088A598
GlobalDeleteAtom.KERNEL32(?), ref: 0088A5A2
CallWindowProcA.USER32(?,?,?,?,00000000), ref: 0088A5F6

Strings

AfxOldWndProc423, xrefs: 0088A501, 0088A506, 0088A58F, 0088A597

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Window$AtomCallGlobalProcProp$DeleteFindH_prolog3_catchLongRectRemove
String ID: AfxOldWndProc423
API String ID: 2109165785-1060338832
Opcode ID: 852d69a52e3690e01c8b59bc91fc41e2701470a1381d480d8b13b222eca84942
Instruction ID: 31dac7105ac72f52b56aa61dab55d0fc47ff9fc137f740af6ed855332fccb861
Opcode Fuzzy Hash: 852d69a52e3690e01c8b59bc91fc41e2701470a1381d480d8b13b222eca84942
Instruction Fuzzy Hash: 10312F3180021AABEF06BFE4DD49EBF7A79FF46311F040115F601E21A1CB358A61DB62

Function 100013F0 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 59stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10001050: lstrlen.KERNEL32 ref: 10001066
Part of subcall function 10001050: _malloc.LIBCMT ref: 1000106E

lstrlen.KERNEL32 ref: 10001478

Strings

r, xrefs: 1000144B
9, xrefs: 10001464
g, xrefs: 1000145F
p, xrefs: 10001450
0, xrefs: 1000146E
3, xrefs: 10001469
w, xrefs: 10001446
s, xrefs: 10001455
n, xrefs: 1000145A

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$_malloc
String ID: 0$3$9$g$n$p$r$s$w
API String ID: 3018943236-3258421149
Opcode ID: 3b9d0c397773fd814065267c12b07003d5c18e608b407e658bda0ad37ab2cb1e
Instruction ID: 497b3459cfcc943a2ee35567d20adbc1497d56e79807d73c826ecf901fc48c5f
Opcode Fuzzy Hash: 3b9d0c397773fd814065267c12b07003d5c18e608b407e658bda0ad37ab2cb1e
Instruction Fuzzy Hash: D621687110C3C19BE315CB68C815B9BBBE5ABDA784F04494CB1D887252DAB9E64887A3

Function 100048C0 Relevance: 15.0, APIs: 1, Strings: 9, Instructions: 42stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 10004916

Part of subcall function 100047A0: _memset.LIBCMT ref: 100047BB

Strings

9, xrefs: 10004907
K, xrefs: 100048E4
5, xrefs: 10004902
e, xrefs: 100048F8
r, xrefs: 100048FD
8, xrefs: 1000490C
h, xrefs: 100048F3
o, xrefs: 100048E9
t, xrefs: 100048EE

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memsetlstrlen
String ID: 5$8$9$K$e$h$o$r$t
API String ID: 508792750-2989816885
Opcode ID: 4855a1a81f284582a7bf6d6c1ae58d7e1eedd7be010077afe38748f007c72a88
Instruction ID: a3642d6cc6c2f9c341d6c0445be83fc3c050222f7d26a568a19089825b521d5c
Opcode Fuzzy Hash: 4855a1a81f284582a7bf6d6c1ae58d7e1eedd7be010077afe38748f007c72a88
Instruction Fuzzy Hash: 57113C7110C3819EE316CB18D845BDFBBE99BEA744F44894DB1C987281CBB9960DC7A3

Function 10001350 Relevance: 15.0, APIs: 1, Strings: 9, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 100013A3

Part of subcall function 100047A0: _memset.LIBCMT ref: 100047BB

Strings

t, xrefs: 10001385
0, xrefs: 10001399
5, xrefs: 1000138F
S, xrefs: 10001371
i, xrefs: 10001380
3, xrefs: 10001394
e, xrefs: 1000137B
k, xrefs: 10001376
_, xrefs: 1000138A

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memsetlstrlen
String ID: 0$3$5$S$_$e$i$k$t
API String ID: 508792750-1352559841
Opcode ID: a9f8519f0f2c2a09a154380c69e4c2ec1469d59b75a014346d83081cdd5c3350
Instruction ID: 2b2ab4ca0e406aabb42c731482fa99e30ce040560576e9e22d25adad32a7f54e
Opcode Fuzzy Hash: a9f8519f0f2c2a09a154380c69e4c2ec1469d59b75a014346d83081cdd5c3350
Instruction Fuzzy Hash: 0801707140C3C0AAE316CB18C8457DFBFD99BA6344F04C80DB1C947192C6B99288C7A3

Function 0089E9BA Relevance: 13.6, APIs: 9, Instructions: 146librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 0089E9FF
GetLastError.KERNEL32 ref: 0089EA0B
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0089EA3E
InterlockedExchange.KERNEL32(?,00000000), ref: 0089EA50
LocalAlloc.KERNEL32(00000040,00000008), ref: 0089EA64
FreeLibrary.KERNEL32(00000000), ref: 0089EA81
GetProcAddress.KERNEL32(?,?), ref: 0089EAD6
GetLastError.KERNEL32(?,?), ref: 0089EAE2
RaiseException.KERNEL32(C06D007F,00000000,00000001,?,?,?), ref: 0089EB14

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID:
API String ID: 991255547-0
Opcode ID: 3a34b6ddb49e94232832d4d8573a7713307c0307e56f53a02a1a948382276ae5
Instruction ID: 2da613d9aad2e852785c547445ff3b8d3eb291490a95b80b3a9971643838f5c7
Opcode Fuzzy Hash: 3a34b6ddb49e94232832d4d8573a7713307c0307e56f53a02a1a948382276ae5
Instruction Fuzzy Hash: 2A51F67160021A9FEF11EF94D984BAD7BF5FB68311F184129E645E76A0EB70AD44CB20

Function 008862DC Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 008862E3
EnterCriticalSection.KERNEL32(?,00000010,0088659F,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 008862F4
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00886312
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00886346
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 008863B2
_memset.LIBCMT ref: 008863D1
TlsSetValue.KERNEL32(?,00000000), ref: 008863E2
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00886403

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: e99bb6fabe0027d971eb5d68cd6deee29a07a930239a89d3a9d3092978710606
Instruction ID: b0773b343458d3d5d8626c9a91200e1ac3d3941b6df8319b54cfb81a12856cc3
Opcode Fuzzy Hash: e99bb6fabe0027d971eb5d68cd6deee29a07a930239a89d3a9d3092978710606
Instruction Fuzzy Hash: D5319E70500606EFDB21BF24DC85DAABBA1FF05310B20C52DE556D7A51EB30AE60DF91

Function 00884431 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00884391: GetParent.USER32(?), ref: 008843E5
Part of subcall function 00884391: GetLastActivePopup.USER32(?), ref: 008843F6
Part of subcall function 00884391: IsWindowEnabled.USER32(?), ref: 0088440A
Part of subcall function 00884391: EnableWindow.USER32(?,00000000), ref: 0088441D

EnableWindow.USER32(?,00000001), ref: 0088447E
GetWindowThreadProcessId.USER32(?,?), ref: 00884492
GetCurrentProcessId.KERNEL32 ref: 0088449C
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 008844B4
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0088452E
EnableWindow.USER32(00000000,00000001), ref: 00884573

Strings

0, xrefs: 00884509

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: c13e787f8b333ef67dc360f7cd480931f5a9009b4babfcafe7987be1d95b19a2
Instruction ID: 2c50847757dc17c3e908c8b4f51ba28e53df0c248d26828e320ebac0037df66c
Opcode Fuzzy Hash: c13e787f8b333ef67dc360f7cd480931f5a9009b4babfcafe7987be1d95b19a2
Instruction Fuzzy Hash: 26417173A0031AABDB25AF24CC45BDEB7B8FF05714F141598F659E6280D7B09E808F91

Function 100049F0 Relevance: 12.2, APIs: 8, Instructions: 159COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10004A22

Part of subcall function 10004960: select.WS2_32 ref: 1000499A
Part of subcall function 10004960: __WSAFDIsSet.WS2_32(?,00000000), ref: 100049AA
Part of subcall function 10004960: recv.WS2_32(?,?,?,?), ref: 100049CC

Part of subcall function 100048C0: lstrlen.KERNEL32 ref: 10004916

_malloc.LIBCMT ref: 10004AAE

Part of subcall function 1000523F: __FF_MSGBANNER.LIBCMT ref: 10005262
Part of subcall function 1000523F: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001), ref: 100052B6

_memset.LIBCMT ref: 10004AB9
_memset.LIBCMT ref: 10004AE3
_realloc.LIBCMT ref: 10004B1D

Part of subcall function 10005940: _malloc.LIBCMT ref: 10005956

_memset.LIBCMT ref: 10004B4A
_malloc.LIBCMT ref: 10004B90
_memset.LIBCMT ref: 10004B9B

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: _memset$_malloc$AllocateHeap_realloclstrlenrecvselect
String ID:
API String ID: 1349317492-0
Opcode ID: 3ee342fb0321024b760cefbc6eb38936767aa0396e85e9cf867c2d27ab93653a
Instruction ID: 56148a727e19b04945c7e4c4e53b130ac6079e60b658ffb6dbe039032bbc2272
Opcode Fuzzy Hash: 3ee342fb0321024b760cefbc6eb38936767aa0396e85e9cf867c2d27ab93653a
Instruction Fuzzy Hash: 235194756043006BE214DB149C81FAFB3E9EFC8684F41495CF58997146EF71FA098BE6

Function 00881E66 Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 00881E85
lstrcmpA.KERNEL32(?,?), ref: 00881E91
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 00881EA3
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00881EC3
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00881ECB
GlobalLock.KERNEL32(00000000), ref: 00881ED5
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 00881EE2
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00881EFA

Part of subcall function 00885E10: GlobalFlags.KERNEL32(?), ref: 00885E1F
Part of subcall function 00885E10: GlobalUnlock.KERNEL32(?), ref: 00885E31
Part of subcall function 00885E10: GlobalFree.KERNEL32(?), ref: 00885E3C

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: e172d95ef8d810d67320219df48131e44576e4116719cdf85a862176e8e1b46c
Instruction ID: 4bd329d2d535da6da496c724658955d47011f31f5a9d0641e5b4f4b5a6abba1b
Opcode Fuzzy Hash: e172d95ef8d810d67320219df48131e44576e4116719cdf85a862176e8e1b46c
Instruction Fuzzy Hash: 0E118CB2500600BBEF22BBA9CC49D6F7AADFF85700B040419BA01D2821DA31D9529B21

Function 00888F0F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00888F9E
SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00888FC7
GetWindowLongA.USER32(?,000000FC), ref: 00888FD9
GetWindowLongA.USER32(?,000000FC), ref: 00888FEA
SetWindowLongA.USER32(?,000000FC,?), ref: 00889006

Strings

,, xrefs: 00888FBD

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: 4396b74659ecb34617b76f577fab8e9255762c93b7644db6f45d80db956f4256
Instruction ID: d725fb6ef7fb77b1e1198fe51ba5597a1495cb183e02c4a8bbbc0f62f9462ce6
Opcode Fuzzy Hash: 4396b74659ecb34617b76f577fab8e9255762c93b7644db6f45d80db956f4256
Instruction Fuzzy Hash: 7C316D71600B14DFDB20BFA8D888A6EBBA5FF48310F550529E646D7692DF31E804CB95

Function 00883F91 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00883F9B
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00884081
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0088409E
RegCloseKey.ADVAPI32(?), ref: 008840BE
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 008840D9

Strings

Software\, xrefs: 00883FFF

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: 4f386227d7e524b6c5a60490b7bed06179ee9c7082366760c47177e456da1657
Instruction ID: 95d4b277ec70c2d720a0760f142e0618aee17731e1cd5360011cad9b098bd474
Opcode Fuzzy Hash: 4f386227d7e524b6c5a60490b7bed06179ee9c7082366760c47177e456da1657
Instruction Fuzzy Hash: 8A41A071900618ABCB22FB68CC41ADEB7B8FF49710F1406D5F245E2192DB349B91CF51

Function 00883E13 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00883E1D
RegOpenKeyA.ADVAPI32(?,?,?), ref: 00883EAB
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00883ECE

Part of subcall function 00883D6F: __EH_prolog3.LIBCMT ref: 00883D76

Strings

Software\Classes\, xrefs: 00883E5E

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: EnumH_prolog3H_prolog3_catch_Open
String ID: Software\Classes\
API String ID: 3518408925-1121929649
Opcode ID: e3bf95a33c13648b876ccc60a8ba0c3f289e7d1e35547b25c3f839eecb81b9c4
Instruction ID: 75e2452b10f794097edd0fcd8801d5f98cce7a7da4455966646a3886b82adc83
Opcode Fuzzy Hash: e3bf95a33c13648b876ccc60a8ba0c3f289e7d1e35547b25c3f839eecb81b9c4
Instruction Fuzzy Hash: 9B313E72C00168ABDB22FB68CC45BDDB7B4FF09710F1441D5E999A3252DA305F949F91

Function 008848C9 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 008848D6
SendMessageA.USER32(?,00000365,00000000,00000000), ref: 008848F1
GetFocus.USER32 ref: 00884906
SendMessageA.USER32(?,00000365,00000000,00000000), ref: 00884914
GetLastActivePopup.USER32(?), ref: 0088493D
SendMessageA.USER32(?,00000365,00000000,00000000), ref: 0088494A

Part of subcall function 0088A071: GetWindowLongA.USER32(?,000000F0), ref: 0088A097
Part of subcall function 0088A071: GetParent.USER32(?), ref: 0088A0A5

SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 00884970

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: fbb4bc274bfd41a9d8f503f84267bda520ec42a167bdb4548d2a8824fcc0db5d
Instruction ID: d41117805420c5c9670c5fdfcd41c289e4aff30253ee04949d01c36a89511e95
Opcode Fuzzy Hash: fbb4bc274bfd41a9d8f503f84267bda520ec42a167bdb4548d2a8824fcc0db5d
Instruction Fuzzy Hash: 0811F97290111AFBEF247BA5CD85C6FBE78FB51789B201075E601E6171D7318E00AB21

Function 008849A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 008849D9
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 008849FC
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00884A18
RegCloseKey.ADVAPI32(?), ref: 00884A28
RegCloseKey.ADVAPI32(?), ref: 00884A32

Strings

software, xrefs: 008849C1

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: b03a02807abc8e1f441524ae03d88fe2de16d6eb92a5124eccdf43136aaa1515
Instruction ID: 6e5e6761a3c818917faff661fa9afe24896eabfc7819f7bf3ae3a01700957660
Opcode Fuzzy Hash: b03a02807abc8e1f441524ae03d88fe2de16d6eb92a5124eccdf43136aaa1515
Instruction Fuzzy Hash: CA11B672900259BB9B21DF9ACD88DDFBFBDFB89710B1000AAA505E2121D7719A44DB60

Function 0088637D Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?), ref: 00886384
__CxxThrowException@8.LIBCMT ref: 0088638E

Part of subcall function 008914AC: RaiseException.KERNEL32(?,?,?,?), ref: 008914EE

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 008863A5
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 008863B2

Part of subcall function 008847C3: __CxxThrowException@8.LIBCMT ref: 008847D9

_memset.LIBCMT ref: 008863D1
TlsSetValue.KERNEL32(?,00000000), ref: 008863E2
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00886403

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 7ae27919f72121d8f20634747412c18ffa7e5e601e9156022115d04c19fec034
Instruction ID: 5b1253063a3e423f7057aa19abcd05d3419ecc47f5f77863f49d9a79274c5bcb
Opcode Fuzzy Hash: 7ae27919f72121d8f20634747412c18ffa7e5e601e9156022115d04c19fec034
Instruction Fuzzy Hash: 0B116D74500605AFEB11BF68DC89D6BBBB9FF05314B20C529F566D6A22DB31AC20CF51

Function 0088BBAC Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0088BBBA
GetSysColor.USER32(00000010), ref: 0088BBC1
GetSysColor.USER32(00000014), ref: 0088BBC8
GetSysColor.USER32(00000012), ref: 0088BBCF
GetSysColor.USER32(00000006), ref: 0088BBD6
GetSysColorBrush.USER32(0000000F), ref: 0088BBE3
GetSysColorBrush.USER32(00000006), ref: 0088BBEA

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 8734606c80908c0f12cb7c738533bcb02301b0267db61e3eaa9784d2e1144a78
Instruction ID: b625b6b869bc24a8ca5802f74106890c025a4d9e2e489cdf60eea1d1af502713
Opcode Fuzzy Hash: 8734606c80908c0f12cb7c738533bcb02301b0267db61e3eaa9784d2e1144a78
Instruction Fuzzy Hash: 0EF01C719417489BE730BF769D09B47BAE1FFC4B10F12092EE2858BA90E6B6E441DF40

Function 100028D0 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5540e0b6376b6317fd0047b61af9ff2008d22b21ad47509129865822010e15
Instruction ID: 7dd8f6d779e09c532bddc243db992255002c678a3af0241584c6fac205a1a6c4
Opcode Fuzzy Hash: 2a5540e0b6376b6317fd0047b61af9ff2008d22b21ad47509129865822010e15
Instruction Fuzzy Hash: 073192B5600304ABF751CF68DC81B6B77E9EF88794F054129FA48D7286E770E850C7A1

Function 00884391 Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 008843C4
GetParent.USER32(?), ref: 008843D2
GetParent.USER32(?), ref: 008843E5
GetLastActivePopup.USER32(?), ref: 008843F6
IsWindowEnabled.USER32(?), ref: 0088440A
EnableWindow.USER32(?,00000000), ref: 0088441D

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 1ed0e1d570c3f822a0cd42931797ca33fba4e0d1be32fb326f52e9ed7b7ba141
Instruction ID: bf2cd76c30a6f91c6e6108bae70743274d7cbf776a0f93e13bc064e1e26a274d
Opcode Fuzzy Hash: 1ed0e1d570c3f822a0cd42931797ca33fba4e0d1be32fb326f52e9ed7b7ba141
Instruction Fuzzy Hash: 46119133602633ABDB323A599C44F2EB698FF55B61F152215EC04E7300DB71CC0187A5

Function 100034C0 Relevance: 9.1, APIs: 6, Instructions: 61fileCOMMON

Download Yara Rule

APIs

Part of subcall function 100016E0: GetCurrentProcess.KERNEL32(00000028,04B08C62), ref: 100016F4
Part of subcall function 100016E0: OpenProcessToken.ADVAPI32(00000000), ref: 100016FB
Part of subcall function 100016E0: LookupPrivilegeValueA.ADVAPI32 ref: 10001768
Part of subcall function 100016E0: AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 10001793
Part of subcall function 100016E0: CloseHandle.KERNELBASE ref: 1000179D

OpenProcess.KERNEL32(00000040,00000000,00000000,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 100034DB
CreateFileA.KERNEL32(100193F8,80000000,00000000,00000000,00000003,00000080,00000000,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 1000350A
CloseHandle.KERNEL32(00000000,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 10003516
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000003,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 10003532
DuplicateHandle.KERNEL32(00000000,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 10003539
CloseHandle.KERNEL32(00000000,?,100193F8,00000000,100193F8,10003D77,C:\Windows\SystemNvwmiShell\NvwmiShell.exe), ref: 10003542

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: HandleProcess$Close$CurrentOpenToken$AdjustCreateDuplicateFileLookupPrivilegePrivilegesValue
String ID:
API String ID: 1199507832-0
Opcode ID: 02172e177f3dfb14f2c5a42cbfe5547a8897d3d41bfac8f83edf8f423a97b249
Instruction ID: ed0a4abee65e0af202ecdafec9b2291535b23e0e4caf41ee78f2b4d193e4b7f4
Opcode Fuzzy Hash: 02172e177f3dfb14f2c5a42cbfe5547a8897d3d41bfac8f83edf8f423a97b249
Instruction Fuzzy Hash: C10188B37412106AF22297A5EC8DF8B675CEBD97B1F218226F302DA0D1CA74E814C374

Function 10002200 Relevance: 9.1, APIs: 6, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000003,00000003,00000000,00000003,00000080,00000000,00000000,100023F4,?,?,00000000,?,?,?,?), ref: 10002215
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 10002234
CloseHandle.KERNEL32(00000000), ref: 10002241

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: CreateFile$CloseHandleMapping
String ID:
API String ID: 2353530451-0
Opcode ID: 54925720b7f1eca1df78ee0a410d90665a6d6e7e24323ccb5e54540a355b0d99
Instruction ID: cc518ea6fdabfc06b55dab28d1b7a09f89e67e13a145a9ed39cc1245d229224b
Opcode Fuzzy Hash: 54925720b7f1eca1df78ee0a410d90665a6d6e7e24323ccb5e54540a355b0d99
Instruction Fuzzy Hash: A401F9733853247AF23296B8AC8AF5B1658E788FB4F114722F700FA1C5C6B09841C268

Function 10003560 Relevance: 9.0, APIs: 6, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 10003578
GetFileSize.KERNEL32(?,?,00000000,00000000), ref: 10003599
_malloc.LIBCMT ref: 100035A5
_memset.LIBCMT ref: 100035B0
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 100035C2
CloseHandle.KERNEL32(00000000), ref: 100035C9

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize_malloc_memset
String ID:
API String ID: 3209421157-0
Opcode ID: 1191510d0358fba0f37515c74336381b7dd8cd7ea2a6c81f29df921cb7486482
Instruction ID: 31527ba9eb8b3389904ea49f2e61f3caff14032329e749df33655cd59074d2a6
Opcode Fuzzy Hash: 1191510d0358fba0f37515c74336381b7dd8cd7ea2a6c81f29df921cb7486482
Instruction Fuzzy Hash: EA01F9763403107BF2209BA19C89F57BBACEB99BA2F108605F601921C2D671B514C770

Function 0089495B Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00894983

Part of subcall function 0088F00A: __getptd.LIBCMT ref: 0088F018
Part of subcall function 0088F00A: __getptd.LIBCMT ref: 0088F026

__getptd.LIBCMT ref: 0089498D

Part of subcall function 0089335C: __getptd_noexit.LIBCMT ref: 0089335F
Part of subcall function 0089335C: __amsg_exit.LIBCMT ref: 0089336C

__getptd.LIBCMT ref: 0089499B
__getptd.LIBCMT ref: 008949A9
__getptd.LIBCMT ref: 008949B4
_CallCatchBlock2.LIBCMT ref: 008949DA

Part of subcall function 0088F0AF: __CallSettingFrame@12.LIBCMT ref: 0088F0FB

Part of subcall function 00894A81: __getptd.LIBCMT ref: 00894A90
Part of subcall function 00894A81: __getptd.LIBCMT ref: 00894A9E

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: d54ecf7bc8b12c48ae8d4d90364a071ac110c6d95842f502b524802718562e01
Instruction ID: dc13b079308999f5756a19a7b3b8332ee0ed6ba5fa0f943007db9645fa418810
Opcode Fuzzy Hash: d54ecf7bc8b12c48ae8d4d90364a071ac110c6d95842f502b524802718562e01
Instruction Fuzzy Hash: E711C6B5D40209DFDF00EFA8D545AAD7BB0FF04315F188169F828E7352DB389A119B55

Function 00885E9B Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00885EAC
GetDlgCtrlID.USER32(00000000), ref: 00885EC0
GetWindowLongA.USER32(00000000,000000F0), ref: 00885ED0
GetWindowRect.USER32(00000000,?), ref: 00885EE2
PtInRect.USER32(?,?,?), ref: 00885EF2
GetWindow.USER32(?,00000005), ref: 00885EFF

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 271a6f3eba5e1ca209bd753fe95bacc72cf9375d647edd91d4c39bd4e08a809d
Instruction ID: 7f0d4345f498a4cbf82223bf84084fa15d877d8ab5496458f8f8b6e5c7b29ef9
Opcode Fuzzy Hash: 271a6f3eba5e1ca209bd753fe95bacc72cf9375d647edd91d4c39bd4e08a809d
Instruction Fuzzy Hash: 70014F32140A1AABEB126B549C0CFEF3B6CFF42750F144111F919D6560EB70DA159B94

Function 0088B668 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0088B698

Strings

AfxMDIFrame90s, xrefs: 0088B739
AfxFrameOrView90s, xrefs: 0088B75E
@, xrefs: 0088B83D
@, xrefs: 0088B7A4

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90s$AfxMDIFrame90s
API String ID: 2102423945-455206835
Opcode ID: 046e927218373c241d19579de07e93d6191e28eb24303c60a83174a3d24d7407
Instruction ID: e12af278b75b5c63832f14c75163963666e9f79d646f2a8f8ccbf093f1e804a7
Opcode Fuzzy Hash: 046e927218373c241d19579de07e93d6191e28eb24303c60a83174a3d24d7407
Instruction Fuzzy Hash: 5E910071C00209AADB50EFE8C985BEEBFF8FF44384F148565F958E6281E7748A45CB91

Function 0088320E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 00883226
_memset.LIBCMT ref: 0088329E
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 00883301
LoadBitmapA.USER32(00000000,00007FE3), ref: 00883319

Strings

, xrefs: 0088327F

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: d755a3ac7f696d0c8af53197d6b097daf366936af2eba4de92bb1eb74a3df1cd
Instruction ID: 79f703951d09fc0fec2b5eabf70f5e1b5ae5a0abb4ad61ccc0e587fb70935267
Opcode Fuzzy Hash: d755a3ac7f696d0c8af53197d6b097daf366936af2eba4de92bb1eb74a3df1cd
Instruction Fuzzy Hash: E1313971A002299FEB20DF289C85BAD77B5FF45701F5541AAE648DB281DF358E448F60

Function 00886BC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 00886C07
GetSystemMetrics.USER32(00000000), ref: 00886C1F
GetSystemMetrics.USER32(00000001), ref: 00886C26

Strings

DISPLAY, xrefs: 00886C43
B, xrefs: 00886BE6

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 9094a39f6dd7999dffc46270c331bf8fe2841823939ca7aa974b761bc42baf1b
Instruction ID: f86330ea56350da4295a7149883eb56c6dbd3ef3ca32d7c0dc786609c64df4e5
Opcode Fuzzy Hash: 9094a39f6dd7999dffc46270c331bf8fe2841823939ca7aa974b761bc42baf1b
Instruction Fuzzy Hash: 34110A71A00335ABDF11AF558C89A5B7BA9FF15754F004051FD05EF001E2B1D860CBD0

Function 10001C00 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 23COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32 ref: 10001C39

Strings

e, xrefs: 10001C2A
p, xrefs: 10001C25
o, xrefs: 10001C20
n, xrefs: 10001C2F

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: ExecuteShell
String ID: e$n$o$p
API String ID: 587946157-871044830
Opcode ID: d8419359cd6921bee7f1bae0301479e1da1c1fcd312d0f6f65d9659bc83fa38b
Instruction ID: 35e76cf24916bd7ca4872c5a0456c41876b9972921a251454c1739a729c09528
Opcode Fuzzy Hash: d8419359cd6921bee7f1bae0301479e1da1c1fcd312d0f6f65d9659bc83fa38b
Instruction Fuzzy Hash: B7F0307120C382AEE301CF28CC46B1BBFD59BA5744F04481DF5844A2D1C6B6E65C87A7

Function 008946AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 008946C4

Part of subcall function 0089335C: __getptd_noexit.LIBCMT ref: 0089335F
Part of subcall function 0089335C: __amsg_exit.LIBCMT ref: 0089336C

__getptd.LIBCMT ref: 008946D5
__getptd.LIBCMT ref: 008946E3

Strings

csm, xrefs: 008946BD
MOC, xrefs: 008946B6

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 9313b0a63940b20f3723c3dde8c3233a839a13e8f6a295f1473664cf96a1f44a
Instruction ID: a9c8534636844558e0b6d749421c97edddc9adf58c60080c720f4b6014637e4b
Opcode Fuzzy Hash: 9313b0a63940b20f3723c3dde8c3233a839a13e8f6a295f1473664cf96a1f44a
Instruction Fuzzy Hash: BBE04F791101049FDF14BB7CD046B2933E4FB5A318F5D04A1E40CCB322DB34E954AA43

Function 10001F90 Relevance: 7.6, APIs: 5, Instructions: 77timefileCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 10001F96

Part of subcall function 1000516E: GetSystemTimeAsFileTime.KERNEL32(?), ref: 10005179
Part of subcall function 1000516E: __aulldiv.LIBCMT ref: 10005199

Part of subcall function 10005309: __getptd.LIBCMT ref: 1000530E

Part of subcall function 100011A0: _rand.LIBCMT ref: 100011B0

SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,100023EC,?,00000000,?,?,?,?,?), ref: 1000204C
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,100023EC,?,00000000), ref: 10002066
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,100023EC,?,00000000,?,?,?), ref: 1000207F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,100023EC,?,00000000,?,?,?,?,?), ref: 10002086

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Time$File$System$CloseCreateHandle__aulldiv__getptd__time64_rand
String ID:
API String ID: 2473678566-0
Opcode ID: 12dfa8a92c523efd9b2eed40b42960f2af2a7482309777bca0f9bad4f338e62e
Instruction ID: 3570ec03bd9b24081d753435d9d9933ec8cbddc5c6157c969ca5ba67566165f6
Opcode Fuzzy Hash: 12dfa8a92c523efd9b2eed40b42960f2af2a7482309777bca0f9bad4f338e62e
Instruction Fuzzy Hash: 1F217C38A8534076F618EBA0DC12FDF2555DF88B80F800509F7456F2D2DAB4E64483DA

Function 10004E20 Relevance: 7.6, APIs: 5, Instructions: 70synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 100058DB: _malloc.LIBCMT ref: 100058F5

_malloc.LIBCMT ref: 10004E3A

Part of subcall function 1000523F: __FF_MSGBANNER.LIBCMT ref: 10005262
Part of subcall function 1000523F: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001), ref: 100052B6

_memset.LIBCMT ref: 10004E45

Part of subcall function 10006377: __atof_l.LIBCMT ref: 10006381

CreateThread.KERNEL32(00000000,00000000,10004CC0,00000000,00000000,00000000), ref: 10004E9D
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?), ref: 10004EA8
CloseHandle.KERNEL32(00000000,?,?,?,?,?), ref: 10004EAF

Part of subcall function 1000544A: __lock.LIBCMT ref: 10005468
Part of subcall function 1000544A: ___sbh_find_block.LIBCMT ref: 10005473
Part of subcall function 1000544A: ___sbh_free_block.LIBCMT ref: 10005482
Part of subcall function 1000544A: HeapFree.KERNEL32(00000000,00000001,10014040,0000000C,10006CF5,00000000,10014130,0000000C,10006D2F,00000001,100080A1,?,1000E911,00000004,10014340,0000000C), ref: 100054B2
Part of subcall function 1000544A: GetLastError.KERNEL32 ref: 100054C3

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Heap_malloc$AllocateCloseCreateErrorFreeHandleLastObjectSingleThreadWait___sbh_find_block___sbh_free_block__atof_l__lock_memset
String ID:
API String ID: 12303079-0
Opcode ID: 72a8b30b413437493614e1813aed7f996f65fd18697cdf3e184840b191701fdb
Instruction ID: fcb5794e8b8b9a4163bf16340213ba0dcbf40501c817dc2ef2a183bdc6f2fa1a
Opcode Fuzzy Hash: 72a8b30b413437493614e1813aed7f996f65fd18697cdf3e184840b191701fdb
Instruction Fuzzy Hash: 7F216DB5604304AFE360DF25CC81F1BBBF8EF88691F108A2DF54A97255DA71F9408B61

Function 00885D51 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?), ref: 00885D7D
_memset.LIBCMT ref: 00885D9A
GetWindowTextA.USER32(00000000,00000000,00000100), ref: 00885DB4
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 00885DC6
SetWindowTextA.USER32(00000000,?), ref: 00885DD2

Part of subcall function 008847FB: __CxxThrowException@8.LIBCMT ref: 00884811

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
String ID:
API String ID: 289641511-0
Opcode ID: 1a181134e5d775a01d2af73220a02bbf3a1962f0bd057ab9bd5d2efb5975cb6b
Instruction ID: f399b43925eeeee5600267708cc7c07489b2ef972c72d96e79e3255ccd18751b
Opcode Fuzzy Hash: 1a181134e5d775a01d2af73220a02bbf3a1962f0bd057ab9bd5d2efb5975cb6b
Instruction Fuzzy Hash: F701F5B2600619A7D711BB68DC88FDF776CFF55750F004071FA45D3141EAB09E448BA0

Function 00897E4C Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00897E58

Part of subcall function 0089335C: __getptd_noexit.LIBCMT ref: 0089335F
Part of subcall function 0089335C: __amsg_exit.LIBCMT ref: 0089336C

__amsg_exit.LIBCMT ref: 00897E78
__lock.LIBCMT ref: 00897E88
InterlockedDecrement.KERNEL32(?), ref: 00897EA5
InterlockedIncrement.KERNEL32(02AB1660), ref: 00897ED0

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 47e231118061916e3cdd3ae73c208cae60d7566ab70bc3d370aef7abcd98870a
Instruction ID: 53d78629a72cebadc6550d5258a8cfd092dc805ffdb127184afd0eeb165b6c4d
Opcode Fuzzy Hash: 47e231118061916e3cdd3ae73c208cae60d7566ab70bc3d370aef7abcd98870a
Instruction Fuzzy Hash: 2401AD31A19B21EBEF20BBA99805B9D7760FF41F20F180055F818E7A91CB346D41CBD6

Function 10009B83 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10009B8F

Part of subcall function 100080FE: __getptd_noexit.LIBCMT ref: 10008101
Part of subcall function 100080FE: __amsg_exit.LIBCMT ref: 1000810E

__amsg_exit.LIBCMT ref: 10009BAF
__lock.LIBCMT ref: 10009BBF
InterlockedDecrement.KERNEL32(?), ref: 10009BDC
InterlockedIncrement.KERNEL32(02B91658), ref: 10009C07

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 1130e7cb2f8128682975b784ebcc255f6020dd0aeaba8e578da67b8eb712845c
Instruction ID: b47000df70662b008aae9f95e267f2c68a78c502498fc19181047385635688d2
Opcode Fuzzy Hash: 1130e7cb2f8128682975b784ebcc255f6020dd0aeaba8e578da67b8eb712845c
Instruction Fuzzy Hash: 3C01D235D01B26ABF711DB259889B5D73A0FF057E0F058005F8046B698CBB8AA80CBD2

Function 100038D0 Relevance: 7.5, APIs: 5, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 100038DF
_malloc.LIBCMT ref: 100038EF

Part of subcall function 1000523F: __FF_MSGBANNER.LIBCMT ref: 10005262
Part of subcall function 1000523F: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001), ref: 100052B6

_memset.LIBCMT ref: 100038FA
lstrlen.KERNEL32(?), ref: 10003903
lstrlen.KERNEL32(?), ref: 10003911

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$AllocateHeap_malloc_memset
String ID:
API String ID: 439977837-0
Opcode ID: b7352201762b6831f899ae76f0e8b31efdd25657f965589f54062528081a6ac9
Instruction ID: e9d2ae249df7939ad88245d259f7616acf15b06efc4cc7cf6fc67b8eea126424
Opcode Fuzzy Hash: b7352201762b6831f899ae76f0e8b31efdd25657f965589f54062528081a6ac9
Instruction Fuzzy Hash: CCF0F4761001046BE210DB15ACC1EBBB3EDEFCA68AB404019F80893107EA76FA0587B1

Function 0088E821 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0088E83F

Part of subcall function 00892208: __mtinitlocknum.LIBCMT ref: 0089221E
Part of subcall function 00892208: __amsg_exit.LIBCMT ref: 0089222A
Part of subcall function 00892208: EnterCriticalSection.KERNEL32(00897902,00897902,?,00899513,00000004,008A5C80,0000000C,0089368D,?,00897911,00000000,00000000,00000000,?,0089330E,00000001), ref: 00892232

___sbh_find_block.LIBCMT ref: 0088E84A
___sbh_free_block.LIBCMT ref: 0088E859
HeapFree.KERNEL32(00000000,?,008A5870,0000000C,008921E9,00000000,008A5958,0000000C,00892223,?,00897902,?,00899513,00000004,008A5C80,0000000C), ref: 0088E889
GetLastError.KERNEL32(?,00899513,00000004,008A5C80,0000000C,0089368D,?,00897911,00000000,00000000,00000000,?,0089330E,00000001,00000214), ref: 0088E89A

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: e184ed3f6c2e8a8cfbdd7ca98f2fef2711fe5a0ca0438a10cdce3d522aafecc2
Instruction ID: 38ee69fbd0c04c532a0e69aee8b8d249ab82de563a586b8527ef1d512d8fdcda
Opcode Fuzzy Hash: e184ed3f6c2e8a8cfbdd7ca98f2fef2711fe5a0ca0438a10cdce3d522aafecc2
Instruction Fuzzy Hash: C801D631905315AAEF347FF49C0AB4E7BA4FF01B61F240539F914E6081CB389840CB56

Function 1000544A Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 10005468

Part of subcall function 10006D14: __mtinitlocknum.LIBCMT ref: 10006D2A
Part of subcall function 10006D14: __amsg_exit.LIBCMT ref: 10006D36
Part of subcall function 10006D14: RtlEnterCriticalSection.NTDLL(100080A1), ref: 10006D3E

___sbh_find_block.LIBCMT ref: 10005473
___sbh_free_block.LIBCMT ref: 10005482
HeapFree.KERNEL32(00000000,00000001,10014040,0000000C,10006CF5,00000000,10014130,0000000C,10006D2F,00000001,100080A1,?,1000E911,00000004,10014340,0000000C), ref: 100054B2
GetLastError.KERNEL32 ref: 100054C3

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1084ba4b8e410f98c145e015953ad37175c30c1906fe849f95615375910dd603
Instruction ID: a2c558886b17bd814bcb045e69f192f9ba00e1b976aeeff4cde37557392ca0ec
Opcode Fuzzy Hash: 1084ba4b8e410f98c145e015953ad37175c30c1906fe849f95615375910dd603
Instruction Fuzzy Hash: A201A279D44616AAFB11DBB08C0AB8E36A5EF043E6F318109F4046A099DF39E9C0CB65

Function 00889ED6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0088B9E8: EnterCriticalSection.KERNEL32(008B9428,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA22
Part of subcall function 0088B9E8: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA34
Part of subcall function 0088B9E8: LeaveCriticalSection.KERNEL32(008B9428,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA41
Part of subcall function 0088B9E8: EnterCriticalSection.KERNEL32(?,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA51

Part of subcall function 00885FB0: __EH_prolog3_catch.LIBCMT ref: 00885FB7

Part of subcall function 008847FB: __CxxThrowException@8.LIBCMT ref: 00884811

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 00889F1F
FreeLibrary.KERNEL32(?), ref: 00889F2F

Strings

hhctrl.ocx, xrefs: 00889F03
HtmlHelpA, xrefs: 00889F19

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 3274081130-63838506
Opcode ID: 8a2e9a5165b8f018fcccc9a4704da9779ee4847372b22b693c91b1a500bec676
Instruction ID: 6cad3820b53a2b2c9f0d9b2de6be12eaf396337657d025ecbd854a385355e7e1
Opcode Fuzzy Hash: 8a2e9a5165b8f018fcccc9a4704da9779ee4847372b22b693c91b1a500bec676
Instruction Fuzzy Hash: 3101493114470AEBDF223FA4DC0AB6A3B90FF50312F008814F7AAD1A90EF74C8509792

Function 00894D08 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00894D1B

Part of subcall function 00894C76: ___BuildCatchObjectHelper.LIBCMT ref: 00894CAC

_UnwindNestedFrames.LIBCMT ref: 00894D32
___FrameUnwindToState.LIBCMT ref: 00894D40

Strings

csm, xrefs: 00894D17, 00894D2C, 00894D3F, 00894D5D, 00894D6D

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: e7499f157c9fe119650e9cb92f3ffd1d5921df29dd050c141793363a17fe9802
Instruction ID: 41ad1be59f76f26ac7fb071cdf4424a564dfcc6591b8355aa00100765b6312b3
Opcode Fuzzy Hash: e7499f157c9fe119650e9cb92f3ffd1d5921df29dd050c141793363a17fe9802
Instruction Fuzzy Hash: B0014675000109BFDF12AF55CC41EEA3F6AFF09354F188014FD1894121D736A9B2EBA2

Function 008993A9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00891D7A), ref: 008993AE
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 008993BE

Strings

IsProcessorFeaturePresent, xrefs: 008993B8
KERNEL32, xrefs: 008993A9

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 4086190681a44e49cdcc8bc0c812a1f5cf3286726f9415bcbfb7d3bdaaac9914
Instruction ID: 2bb773f5b39cee2cb8f83e5a56c013da2bf4b0fb458c99bdec9ee3b6b4c2b2b3
Opcode Fuzzy Hash: 4086190681a44e49cdcc8bc0c812a1f5cf3286726f9415bcbfb7d3bdaaac9914
Instruction Fuzzy Hash: E4F03030A41A0DD2EF102FA9AD0E6AF7A78FB81706F861494E5E1F05D4DF708070D745

Function 1000C1E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,100063FA), ref: 1000C1ED
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 1000C1FD

Strings

IsProcessorFeaturePresent, xrefs: 1000C1F7
KERNEL32, xrefs: 1000C1E8

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 34baa8cb0b1ee51566053c426f891fd0f003e7d31af870d2d5cbe19dc2883d8d
Instruction ID: 140c9150048f97d8eaf1189b3b4d5c310c8ba91b4ace1448c6d3f5688a06714d
Opcode Fuzzy Hash: 34baa8cb0b1ee51566053c426f891fd0f003e7d31af870d2d5cbe19dc2883d8d
Instruction Fuzzy Hash: 18F03670900A1DD2FF006FA1AD49A9F7B74FF80745F920590D691E0099DF30C0B0D252

Function 0089B330 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0089B364
__isleadbyte_l.LIBCMT ref: 0089B398
MultiByteToWideChar.KERNEL32(00000080,00000009,0088F848,?,00000000,00000000,?,?,?,?,0088F848,00000000,?), ref: 0089B3C9
MultiByteToWideChar.KERNEL32(00000080,00000009,0088F848,00000001,00000000,00000000,?,?,?,?,0088F848,00000000,?), ref: 0089B437

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 743025aba3839e5db43085a35256c059972912a7133bc0b4e114d773f54be5ea
Instruction ID: 67de4b90c15e8b49ac9e7e8189ce283800ee79162a929ce94e780bd8e11088c7
Opcode Fuzzy Hash: 743025aba3839e5db43085a35256c059972912a7133bc0b4e114d773f54be5ea
Instruction Fuzzy Hash: 17319C31A0029AEFDF20EF64E9849AE3BE5FF01311F1D8569E469CB291E371D940EB51

Function 100102CF Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10010303
__isleadbyte_l.LIBCMT ref: 10010337
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?,?,?,00000000,?,?,00000000), ref: 10010368
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?,?,?,00000000,?,?,00000000), ref: 100103D6

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b3c8c1cce440e36bb6f4094dd90a0142058d731ff677dc01e75f298246b24227
Instruction ID: 4c9da11056820fa63801510a931ad04b3d68b51e4b3ed7c9f6fe4112811a3e35
Opcode Fuzzy Hash: b3c8c1cce440e36bb6f4094dd90a0142058d731ff677dc01e75f298246b24227
Instruction Fuzzy Hash: 99317C31B00296EFDB10DF64C884AAE7BF9FF01291B1585A9F4A18F191D7B1DE80DB51

Function 0088BF74 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__msize.LIBCMT ref: 0088C007
__msize.LIBCMT ref: 0088C02A
_malloc.LIBCMT ref: 0088C042
_malloc.LIBCMT ref: 0088C057

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: 59aaed18376eaae788c5b0fc2eb12e0751c882587698282d2ccb76955b99f90e
Instruction ID: f8b679da85f9795da8697b118d7839c9fb409e9ba935ebaec6bc25faf060c0b4
Opcode Fuzzy Hash: 59aaed18376eaae788c5b0fc2eb12e0751c882587698282d2ccb76955b99f90e
Instruction Fuzzy Hash: 5521A231100B15DFCB25FF38D885A5AB7A5FF80761B248529E818CA246DF30EC81CB96

Function 008866A4 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008866AB

Part of subcall function 008819BA: _malloc.LIBCMT ref: 008819D8

__CxxThrowException@8.LIBCMT ref: 008866E1
FormatMessageA.KERNEL32(00001100,00000000,?,00000800,8007000E,00000000,00000000,00000000,?,8007000E,008A50B4,00000004,00881F7F,8007000E), ref: 0088670C

Part of subcall function 00884817: __cftof.LIBCMT ref: 00884828

LocalFree.KERNEL32(8007000E,8007000E), ref: 00886735

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow__cftof_malloc
String ID:
API String ID: 1808948168-0
Opcode ID: 3c6b9a2eae75a94d7a9dadfeecb9d9dc64bbeb33916168159fbd3f1d0fdb5dda
Instruction ID: 11055172943c02c13cc47618edb35b193788f4e1c7fe10ab6f290e9dae59f9c3
Opcode Fuzzy Hash: 3c6b9a2eae75a94d7a9dadfeecb9d9dc64bbeb33916168159fbd3f1d0fdb5dda
Instruction Fuzzy Hash: 8F115E71604249AFDF01FFA8CC859AA3BA9FF08354F258529F629CA291E63189648B51

Function 008827EF Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008827F6

Part of subcall function 00883743: __EH_prolog3.LIBCMT ref: 0088374A

__strdup.LIBCMT ref: 00882818
GetCurrentThread.KERNEL32 ref: 00882845
GetCurrentThreadId.KERNEL32 ref: 0088284E

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 9c4ff4b2fe9949ced1ecdc4dbccc01d89b2529caba56c9095c1853a5fcaa2cc3
Instruction ID: a3f2c44f3454dfc4034b8c1cea429ccec1166bb0c7c7af30ce91b2164bf77c06
Opcode Fuzzy Hash: 9c4ff4b2fe9949ced1ecdc4dbccc01d89b2529caba56c9095c1853a5fcaa2cc3
Instruction Fuzzy Hash: B6216DB0800B54CFD761AF6AC54564AFAE8FFA4700F10892FE59AC7A22DBB0A545CF45

Function 0088A9CB Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0088A9F7
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0088AA22
GetCapture.USER32 ref: 0088AA34
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 0088AA43

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: bb1c7720a7e5647268887a915b793299918e6a623b1745a86b18b43af27c2d57
Instruction ID: 1d7e035c69178a44934874c1b4040bca75f57811f8026a7bc2fbc5ea79b4c35b
Opcode Fuzzy Hash: bb1c7720a7e5647268887a915b793299918e6a623b1745a86b18b43af27c2d57
Instruction Fuzzy Hash: 31010C313502557BEB353B668C8DFAB3E69EBCAB10F150079B645DA1A6DAA18800DA21

Function 00884A84 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 00884ABF
RegCloseKey.ADVAPI32(00000000), ref: 00884AC8
swprintf.LIBCMT ref: 00884AE5
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00884AF6

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 2d3d87822133d824940c578c313a00bbe94926f920feb3b6374d54ab742c067d
Instruction ID: 437d03e95d16abdc7ba74fa3603082117c78ebe9cfbe8deec6e6a674f0a34358
Opcode Fuzzy Hash: 2d3d87822133d824940c578c313a00bbe94926f920feb3b6374d54ab742c067d
Instruction Fuzzy Hash: B201C07254021ABBDB10EF688C45FBF77ACFF49718F140419FA01E7181DAB4E9058BA5

Function 00889716 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00889726
GetTopWindow.USER32(00000000), ref: 00889765
GetWindow.USER32(00000000,00000002), ref: 00889783

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 4700d4af2de8da9a956c8a514002e7c5eeba21714d36894077e9336b3cae96ad
Instruction ID: e08594c8ca6256d2e0653fd5770d231a856cf7c924e5412ab67ce96de6737152
Opcode Fuzzy Hash: 4700d4af2de8da9a956c8a514002e7c5eeba21714d36894077e9336b3cae96ad
Instruction Fuzzy Hash: 8C01E932010619BBCF237F959C49EEE3B26FF89360F094014FA55A5061C736C962EBA5

Function 008890D2 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 008890DF
GetTopWindow.USER32(00000000), ref: 008890F2

Part of subcall function 008890D2: GetWindow.USER32(00000000,00000002), ref: 00889139

GetTopWindow.USER32(?), ref: 00889122

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 208cde1261e89ef96c52b1a408f8e17693ef1a4bd1c4886e7664aa8ad2d87cf6
Instruction ID: 3a3dec14b0c72d27f9b853d7c5014033d3bb5ef0eaf30bf841c5690ccb02a622
Opcode Fuzzy Hash: 208cde1261e89ef96c52b1a408f8e17693ef1a4bd1c4886e7664aa8ad2d87cf6
Instruction Fuzzy Hash: 37018F3A04561BF79F233B658C0DEBE3A2AFF593A1F084120FD58D1111EB39C9119B91

Function 00899295 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 008992BB

Part of subcall function 008990E0: __fltout2.LIBCMT ref: 0089910C

__cftog_l.LIBCMT ref: 008992E1
__cftoe_l.LIBCMT ref: 00899313

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 88bd5f56dbc00cff0bd6ff8cb461ce9ca562248f7f50f9ac13b4b83085231e67
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: C4117B7204014EBBCF126FC8DC45CEE3F22FB19354B188519FAA898131D636C9B1AB82

Function 1000C0B3 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 1000C0D9

Part of subcall function 1000BEFE: __fltout2.LIBCMT ref: 1000BF2A

__cftog_l.LIBCMT ref: 1000C0FF
__cftoe_l.LIBCMT ref: 1000C131

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 602a6bddc6d59fb7428decce1e43c4d8a631ffc6a3b3bc1e6cdc595f5705a157
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7A113D3640028EBBDF229F84CC02CEE3F62FB19294B558415FE1959135C636D9B2AB81

Function 10003CB0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 10003560: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 10003578

Sleep.KERNEL32(000493E0,?,?), ref: 10003D1B
Sleep.KERNEL32(?,?,?), ref: 10003D23

Part of subcall function 100035E0: _malloc.LIBCMT ref: 10003622
Part of subcall function 100035E0: _memset.LIBCMT ref: 10003656
Part of subcall function 100035E0: lstrlen.KERNEL32(00000000), ref: 1000366F
Part of subcall function 100035E0: lstrlen.KERNEL32(00000001), ref: 10003676
Part of subcall function 100035E0: lstrlen.KERNEL32(?), ref: 10003681
Part of subcall function 100035E0: lstrlen.KERNEL32(?), ref: 10003690
Part of subcall function 100035E0: lstrlen.KERNEL32(?), ref: 1000369F

Part of subcall function 1000544A: __lock.LIBCMT ref: 10005468
Part of subcall function 1000544A: ___sbh_find_block.LIBCMT ref: 10005473
Part of subcall function 1000544A: ___sbh_free_block.LIBCMT ref: 10005482
Part of subcall function 1000544A: HeapFree.KERNEL32(00000000,00000001,10014040,0000000C,10006CF5,00000000,10014130,0000000C,10006D2F,00000001,100080A1,?,1000E911,00000004,10014340,0000000C), ref: 100054B2
Part of subcall function 1000544A: GetLastError.KERNEL32 ref: 100054C3

Strings

8686, xrefs: 10003D01
contr.netmows.com, xrefs: 10003D06

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: lstrlen$Sleep$CreateErrorFileFreeHeapLast___sbh_find_block___sbh_free_block__lock_malloc_memset
String ID: 8686$contr.netmows.com
API String ID: 621558490-3196597963
Opcode ID: b5729765b97d915111ba425bfff4d59f5b8b256d07b64cc766cedeb3f2ffb0be
Instruction ID: 0a00253eec6a7a4423b11cc2afba81e1e5bfe017dc344672bac5d0897f6ad712
Opcode Fuzzy Hash: b5729765b97d915111ba425bfff4d59f5b8b256d07b64cc766cedeb3f2ffb0be
Instruction Fuzzy Hash: E2F0C2B61046017BE716DB148C91F6B73EDEBC4AC4F24851CF64547189EB70F949CBA2

Function 100058DB Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 100058F5

Part of subcall function 1000523F: __FF_MSGBANNER.LIBCMT ref: 10005262
Part of subcall function 1000523F: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001), ref: 100052B6

std::bad_alloc::bad_alloc.LIBCMT ref: 10005918

Part of subcall function 10005871: std::exception::exception.LIBCMT ref: 1000587D

std::bad_exception::bad_exception.LIBCMT ref: 1000592C
__CxxThrowException@8.LIBCMT ref: 1000593A

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 4909aec7c2310be4d9b6bf0c1877b15ca13b04e7b0f4b3ea892b3e5f21f66464
Instruction ID: c4ce98d800f3adc1d18bda069480c67be2a1024ba762491d970c0a992892a227
Opcode Fuzzy Hash: 4909aec7c2310be4d9b6bf0c1877b15ca13b04e7b0f4b3ea892b3e5f21f66464
Instruction Fuzzy Hash: E8F0273840521976FF05D360EC4699F37D8DF812D5B118025FD006909BDF3BEAC08280

Function 008985B8 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 008985C4

Part of subcall function 0089335C: __getptd_noexit.LIBCMT ref: 0089335F
Part of subcall function 0089335C: __amsg_exit.LIBCMT ref: 0089336C

__getptd.LIBCMT ref: 008985DB
__amsg_exit.LIBCMT ref: 008985E9
__lock.LIBCMT ref: 008985F9

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: b5bb38cb4d4cd2b707321def6482cf1fd4306b498bc0ec7f9d56ea7f3e13d40d
Instruction ID: c74fbb528c15b2f24e9cba092ae736c25c4bd484a2611b2c57a0cd0b5d4ca417
Opcode Fuzzy Hash: b5bb38cb4d4cd2b707321def6482cf1fd4306b498bc0ec7f9d56ea7f3e13d40d
Instruction Fuzzy Hash: 89F09032941705DBEF21BBB8980774D73A0FF02720F0D4249E055EB692CF749A459B97

Function 1000A2EF Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000A2FB

Part of subcall function 100080FE: __getptd_noexit.LIBCMT ref: 10008101
Part of subcall function 100080FE: __amsg_exit.LIBCMT ref: 1000810E

__getptd.LIBCMT ref: 1000A312
__amsg_exit.LIBCMT ref: 1000A320
__lock.LIBCMT ref: 1000A330

Memory Dump Source

Source File: 00000001.00000003.1745850751.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000003.1745836166.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000003.1745850751.0000000010020000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_10000000_NvwmiShell.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 4dce794c3abb9fc3ed9643e70079c6227df86e6be215d7788557a72360c3c3b1
Instruction ID: 7776ec8e1991093e0d2b1327e5338a80a73d18ea2ac7c10ad069f1f5a6989d71
Opcode Fuzzy Hash: 4dce794c3abb9fc3ed9643e70079c6227df86e6be215d7788557a72360c3c3b1
Instruction Fuzzy Hash: 52F06D3AD406149BF260DB78C80674833E0FF013E0F618219F544AB6AACB74AB80CB52

Function 00894A81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0088F05D: __getptd.LIBCMT ref: 0088F063
Part of subcall function 0088F05D: __getptd.LIBCMT ref: 0088F073

__getptd.LIBCMT ref: 00894A90

Part of subcall function 0089335C: __getptd_noexit.LIBCMT ref: 0089335F
Part of subcall function 0089335C: __amsg_exit.LIBCMT ref: 0089336C

__getptd.LIBCMT ref: 00894A9E

Strings

csm, xrefs: 00894AAC

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 08ae3d30f84b6224bb1b9e4acddda435e8f1fbde26ebaf411d3120ec5dda5281
Instruction ID: a19983c6b0f6a76b2f3ff87d3fb17c23dc8f72fc9ee2c3d8c098182fd667190b
Opcode Fuzzy Hash: 08ae3d30f84b6224bb1b9e4acddda435e8f1fbde26ebaf411d3120ec5dda5281
Instruction Fuzzy Hash: CA0128358402158FCF34FF28D440AAEB3F5FF14311F1C546AE455D6692DB718992DB46

Function 0088642C Relevance: 5.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0088648B
LeaveCriticalSection.KERNEL32(?), ref: 0088649B
LocalFree.KERNEL32(?), ref: 008864A4
TlsSetValue.KERNEL32(?,00000000), ref: 008864B6

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: fd3ba71388dc05806c902414ff7729bfd6be8c78f56fd2922e503799dfaa22c1
Instruction ID: ddbffabf125e9f35c4821202810223f6ff01247575ef42e7c047d7e26d1413b8
Opcode Fuzzy Hash: fd3ba71388dc05806c902414ff7729bfd6be8c78f56fd2922e503799dfaa22c1
Instruction Fuzzy Hash: F4117971600608EFEB24EF58D884FAAB7B4FF06315F108029E152C75A2DB71A960CF54

Function 0088B9E8 Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(008B9428,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA22
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA34
LeaveCriticalSection.KERNEL32(008B9428,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA41
EnterCriticalSection.KERNEL32(?,?,?,?,?,00885FCB,00000010,00000008,008854B9,0088545C,008835CF,008854C3,0088339D,00881D65), ref: 0088BA51

Part of subcall function 008847FB: __CxxThrowException@8.LIBCMT ref: 00884811

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
String ID:
API String ID: 3253506028-0
Opcode ID: 4c1e289a2232faa97c0082c565e988106bd4320d651d09bd94b91aae20ac0ffd
Instruction ID: d51b468d63e547e458fd6064b8106ed3ec83c4d1a8815c91ed4bdc2cb1d60ea8
Opcode Fuzzy Hash: 4c1e289a2232faa97c0082c565e988106bd4320d651d09bd94b91aae20ac0ffd
Instruction Fuzzy Hash: 2BF0F633A00209ABDB147B68EC45B99BB59FFD2320F410125E394C2352D7349882CF69

Function 00885F44 Relevance: 5.0, APIs: 4, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,00886586,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00885F52
TlsGetValue.KERNEL32(00000000,?,?,?,?,00886586,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00885F66
LeaveCriticalSection.KERNEL32(0000001C,?,?,?,?,00886586,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00885F7C
LeaveCriticalSection.KERNEL32(0000001C,?,?,?,?,00886586,?,00000004,0088549A,008835CF,008854C3,0088339D,00881D65), ref: 00885F87

Memory Dump Source

Source File: 00000001.00000002.1746155523.0000000000881000.00000020.00000001.01000000.00000005.sdmp, Offset: 00880000, based on PE: true

Associated: 00000001.00000002.1746141290.0000000000880000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746177055.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746192749.00000000008A8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746206819.00000000008AA000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746225398.00000000008B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1746254637.00000000008BC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_880000_NvwmiShell.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 98261099a817d9c228259c93e47c437b39ccd2b04e9fdacd9296d16ad18f7041
Instruction ID: bdcb43a96278e2dfad9e3f7a9cb8767fb5918ed097b7e14fb438915242ffa8f2
Opcode Fuzzy Hash: 98261099a817d9c228259c93e47c437b39ccd2b04e9fdacd9296d16ad18f7041
Instruction Fuzzy Hash: 50F082362049049FE730AF68DC88D5AB7EDFF9536035A452AFA16D3612DA30F801CFA0

Analysis Process: HelpSystem.exePID: 4296, Parent PID: 7380COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	52.7%
Signature Coverage:	0.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	65

Executed Functions

Function 10002800 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,0649FEDA,?,?,?,?,?,?,10002918,0649FEDA,10026170,74DF0440,00000000,?,?), ref: 10002814
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,10002918,0649FEDA,10026170,74DF0440,00000000,?,?), ref: 1000281B
LookupPrivilegeValueA.ADVAPI32 ref: 10002888
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 100028B3
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000), ref: 100028BD

Strings

b, xrefs: 1000285D
u, xrefs: 10002862
l, xrefs: 10002876
S, xrefs: 1000284B
r, xrefs: 1000286C
v, xrefs: 10002871
D, xrefs: 10002854
P, xrefs: 10002867

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: D$P$S$b$l$r$u$v
API String ID: 3038321057-2680133038
Opcode ID: 8c82566e12f3aef830bd81e5586479da4618ad9adca5fcfdf5200e034debfd33
Instruction ID: 86c4b361cd7e9e9647a48c7f3e2ee75cceac27c9bb692ae9df1e262ca40207a3
Opcode Fuzzy Hash: 8c82566e12f3aef830bd81e5586479da4618ad9adca5fcfdf5200e034debfd33
Instruction Fuzzy Hash: 0D21106410D380DEE301CB648889B5BBFE46FA9788F04494CF1C85B292C7B5D64CCB6B

Function 10003100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000310F

Part of subcall function 10003E38: __FF_MSGBANNER.LIBCMT ref: 10003E5B
Part of subcall function 10003E38: __NMSG_WRITE.LIBCMT ref: 10003E62
Part of subcall function 10003E38: RtlAllocateHeap.NTDLL(00000000,?,10026128), ref: 10003EAF

GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 10003127
_malloc.LIBCMT ref: 1000313C
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 10003155

Part of subcall function 10003D5B: __lock.LIBCMT ref: 10003D79
Part of subcall function 10003D5B: ___sbh_find_block.LIBCMT ref: 10003D84
Part of subcall function 10003D5B: ___sbh_free_block.LIBCMT ref: 10003D93
Part of subcall function 10003D5B: HeapFree.KERNEL32(00000000,?,10011280,0000000C,10006669,00000000,10011360,0000000C,100066A3,?,?,?,1000C102,00000004,100116D0,0000000C), ref: 10003DC3
Part of subcall function 10003D5B: GetLastError.KERNEL32(?,1000C102,00000004,100116D0,0000000C,1000807C,?,?,00000000,00000000,00000000,?,10007C8F,00000001,00000214), ref: 10003DD4

Strings

0.0.0.0, xrefs: 10003170, 100031A9, 100031DD

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: AdaptersHeapInfo_malloc$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock
String ID: 0.0.0.0
API String ID: 548094864-3771769585
Opcode ID: 5afbc1d8ef4b1f28fa49baa1dd9cc6f985bb315a3fe7a7adf2fb13ef22176e4d
Instruction ID: 13b3eda111712e004b766157a5d44c3bcdc5ac76bcfb479562226956bd4f7a3f
Opcode Fuzzy Hash: 5afbc1d8ef4b1f28fa49baa1dd9cc6f985bb315a3fe7a7adf2fb13ef22176e4d
Instruction Fuzzy Hash: 6F31E2361082C216F313CA3448916EB7BEECB9A6D0F55C668DCD58724AEB27DD0E8351

Function 00401730 Relevance: 34.7, APIs: 4, Strings: 19, Instructions: 183
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(?,00409140), ref: 0040176A
lstrcmpiA.KERNEL32(?,0040913C), ref: 00401780
lstrlen.KERNEL32 ref: 004018F7

Part of subcall function 00401580: _memset.LIBCMT ref: 0040159B

Strings

., xrefs: 004018E3
d, xrefs: 004018DE
6, xrefs: 004018C1
LTY 1.0, xrefs: 004017B6
D, xrefs: 004018D5
1, xrefs: 004017DB
O, xrefs: 00401931
_, xrefs: 004018CB
S, xrefs: 004018D0
b, xrefs: 004018B7
p, xrefs: 00401936
., xrefs: 004018ED
0, xrefs: 004018C6
e, xrefs: 0040193B
a, xrefs: 0040194E
S, xrefs: 00401944
3, xrefs: 004018BC
c, xrefs: 00401949
., xrefs: 004018E8

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: lstrcmpi$_memsetlstrlen
String ID: .$.$.$0$1$3$6$D$LTY 1.0$O$S$S$_$a$b$c$d$e$p
API String ID: 157887750-675284778
Opcode ID: bbbaf384ff21e4a38659183b02c4c53a2477fd56f201dbac27deb99c4e18e97f
Instruction ID: 4bf01a5e1586d977584093c044e02db9ce831f488f93ac3e360f35ad14241ae2
Opcode Fuzzy Hash: bbbaf384ff21e4a38659183b02c4c53a2477fd56f201dbac27deb99c4e18e97f
Instruction Fuzzy Hash: F471927150C3809ED311DB28C844B5BBFE55F99348F04496EF4C867392D6BAD608C7AB

Function 100028E0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 147
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10002800: GetCurrentProcess.KERNEL32(00000028,0649FEDA,?,?,?,?,?,?,10002918,0649FEDA,10026170,74DF0440,00000000,?,?), ref: 10002814
Part of subcall function 10002800: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,10002918,0649FEDA,10026170,74DF0440,00000000,?,?), ref: 1000281B
Part of subcall function 10002800: LookupPrivilegeValueA.ADVAPI32 ref: 10002888
Part of subcall function 10002800: AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 100028B3
Part of subcall function 10002800: CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000), ref: 100028BD

inet_addr.WS2_32(?), ref: 10002922
htonl.WS2_32(00000000), ref: 1000292B
inet_addr.WS2_32(?), ref: 10002934
htonl.WS2_32(00000000), ref: 10002937
inet_addr.WS2_32(?), ref: 1000293F
htonl.WS2_32(00000000), ref: 10002942
CreateSemaphoreA.KERNEL32(00000000,000001F4,000001F4,00000000), ref: 1000298B
GetStdHandle.KERNEL32(000000F5), ref: 100029A0
WaitForSingleObject.KERNEL32(000003A4,000000FF), ref: 100029D1
CreateThread.KERNELBASE(00000000,00000000,100025D0,00000000,00000000,?), ref: 100029FE
CloseHandle.KERNEL32(00000000), ref: 10002A01
ReleaseSemaphore.KERNEL32(000003A4,00000001,00000000), ref: 10002A14
_printf.LIBCMT ref: 10002A39
Sleep.KERNELBASE(00000004), ref: 10002A47
WaitForSingleObject.KERNEL32(000003A4,000000FF), ref: 10002A5F
ReleaseSemaphore.KERNEL32(000003A4,00000001,?), ref: 10002A71
Sleep.KERNEL32(000003E8), ref: 10002A80
Sleep.KERNEL32(000001F4), ref: 10002AB8

Strings

-> %d/%d - %d, xrefs: 10002A34

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: HandleSemaphoreSleephtonlinet_addr$CloseCreateObjectProcessReleaseSingleTokenWait$AdjustCurrentLookupOpenPrivilegePrivilegesThreadValue_printf
String ID: -> %d/%d - %d
API String ID: 4009574119-755143330
Opcode ID: 4034337d87ab06df19aeaa6d61e1cbf4aa3d5902c903d3b287d550b8f9ddec2d
Instruction ID: 695181dd5464a0f6f0be3929049ef5d31a452b1036d52230af5166b4d15058c4
Opcode Fuzzy Hash: 4034337d87ab06df19aeaa6d61e1cbf4aa3d5902c903d3b287d550b8f9ddec2d
Instruction Fuzzy Hash: C4519EB1A00225EFF710DF64CCC5BAA7BB8FB4D790F244619F615D7296DB30A9418B60

Function 10003890 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 213
networkfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 100038F6
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000100,00000000), ref: 10003918
_malloc.LIBCMT ref: 1000392F
_malloc.LIBCMT ref: 1000393B
_memset.LIBCMT ref: 10003949
InternetReadFile.WININET(00000000,00000000,00001388,?), ref: 10003961
_realloc.LIBCMT ref: 10003974
_memset.LIBCMT ref: 10003994
InternetReadFile.WININET(?,00000000,00001388,?), ref: 100039AC
InternetCloseHandle.WININET(?), ref: 100039C5
InternetCloseHandle.WININET(?), ref: 100039CC
lstrlen.KERNEL32(charset=,00000000,charset=,00000000,00000000), ref: 100039F7

Strings

utf-8, xrefs: 10003A54
charset=, xrefs: 100039E3, 100039F0
WinInetGet/0.1, xrefs: 100038E1

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead_malloc_memset$_realloclstrlen
String ID: WinInetGet/0.1$charset=$utf-8
API String ID: 4132294234-2162586370
Opcode ID: d534a56e12c1b13d43eef8ce0d18fd28e9767ce21f22b5b01af4825aa1a13e0c
Instruction ID: 835dc9c0429aa0f09421fd86afab8fd819df953137f35028efcecae1824d2c16
Opcode Fuzzy Hash: d534a56e12c1b13d43eef8ce0d18fd28e9767ce21f22b5b01af4825aa1a13e0c
Instruction Fuzzy Hash: 0A719275608340AFE321DB65CC85FABB7ECEF89790F40492DF54597285EB70E9048BA2

Function 00402180 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 004021CA
__mtinit.LIBCMT ref: 004021D0
_fast_error_exit.LIBCMT ref: 004021DB
__RTC_Initialize.LIBCMT ref: 004021E1
__ioinit.LIBCMT ref: 004021EA
__amsg_exit.LIBCMT ref: 004021F5
GetCommandLineA.KERNEL32 ref: 004021FB
___crtGetEnvironmentStringsA.LIBCMT ref: 00402206
__setargv.LIBCMT ref: 00402210
__amsg_exit.LIBCMT ref: 0040221B
__setenvp.LIBCMT ref: 00402221
__amsg_exit.LIBCMT ref: 0040222C
__cinit.LIBCMT ref: 00402234
__amsg_exit.LIBCMT ref: 0040223F

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 422c5b5c5c188eb35223f22301f379e21c3a9d62d07f02222985bfe9f004553d
Instruction ID: a5775a0953094faddf1cef18157058f38ca6e4d5c2192367ef4576ada79c8b53
Opcode Fuzzy Hash: 422c5b5c5c188eb35223f22301f379e21c3a9d62d07f02222985bfe9f004553d
Instruction Fuzzy Hash: B92197B19002019AEB107FB2EE0AB6A36686F40719F50417FF604B91D2DBBDC9819A5D

Function 100025D0 Relevance: 16.7, APIs: 11, Instructions: 160
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10002634
socket.WS2_32(00000002,00000001,00000006), ref: 10002649
htons.WS2_32(000001BD), ref: 1000266D
htonl.WS2_32(?), ref: 10002678
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 10002692
connect.WS2_32(00000000,?,00000010), ref: 100026A8
select.WS2_32(00000000,00000000,?,00000000,10026108), ref: 100026F9
send.WS2_32(00000000,100245D0,00000089,00000000), ref: 10002719
select.WS2_32(00000000,?,00000000,00000000,10026108), ref: 10002769
recv.WS2_32(00000000,?,00000400,00000000), ref: 10002781
inet_ntoa.WS2_32(?), ref: 10002790

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: select$_memsetconnecthtonlhtonsinet_ntoaioctlsocketrecvsendsocket
String ID:
API String ID: 20693094-0
Opcode ID: 4608bbc8322a49401af40bdde809952552d8ac664fdac39578e61715bde80972
Instruction ID: 26b25ee1331adbdff5ef06106ca32a399145e1704cf96ee4613921f5ada663ff
Opcode Fuzzy Hash: 4608bbc8322a49401af40bdde809952552d8ac664fdac39578e61715bde80972
Instruction Fuzzy Hash: F251F370904318ABFB10DF64CC85BEE73B4FB48790F204669F91AE65D8EB705981CB25

Function 00401450 Relevance: 9.1, APIs: 6, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c456d58bd07327f8cc3e08e627c9f83f2a48e718a501207197c894143b3646
Instruction ID: a9aa53ac70811430420a539581a3bd82a43cdeb95e1aba65c4001a27a6a4870a
Opcode Fuzzy Hash: 62c456d58bd07327f8cc3e08e627c9f83f2a48e718a501207197c894143b3646
Instruction Fuzzy Hash: 103164716002006BE715DF68DC81F6B77A9AF84758F04402AFA49EB3A2E775E901C759

Function 004011F0 Relevance: 7.6, APIs: 5, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040121B
LoadLibraryA.KERNELBASE(?,?,00000014), ref: 0040123E
_realloc.LIBCMT ref: 0040125D

Part of subcall function 00401D8A: _malloc.LIBCMT ref: 00401DA0

GetProcAddress.KERNEL32(00000000,?), ref: 004012A2
IsBadReadPtr.KERNEL32(?,00000014), ref: 004012C9

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: Read$AddressLibraryLoadProc_malloc_realloc
String ID:
API String ID: 3858321205-0
Opcode ID: 1846c2a45a5faf57d4ee2bd302cd70910e0151b02680ddb7ebbeee768ca1f011
Instruction ID: 4142f6d2b2a5e1cda1719cdaf65d2d1b171473974356da5c574ad30993c7b78f
Opcode Fuzzy Hash: 1846c2a45a5faf57d4ee2bd302cd70910e0151b02680ddb7ebbeee768ca1f011
Instruction Fuzzy Hash: 5031BC727002069BD7208F69D880A26F3A8FF80365F14057FE915F73A1D735E8159AA8

Function 004020D8 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004020F2

Part of subcall function 0040334F: __FF_MSGBANNER.LIBCMT ref: 00403372
Part of subcall function 0040334F: __NMSG_WRITE.LIBCMT ref: 00403379
Part of subcall function 0040334F: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 004033C6

std::bad_alloc::bad_alloc.LIBCMT ref: 00402115

Part of subcall function 0040206E: std::exception::exception.LIBCMT ref: 0040207A

std::bad_exception::bad_exception.LIBCMT ref: 00402129
__CxxThrowException@8.LIBCMT ref: 00402137

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 0c5b9512872b4aeaaa1b5bb0df855a1828bfd12c6f40315308b768f8d07780de
Instruction ID: cf5248a7b312d72e7fbef3a0cb30a2894c3351b1273888cecde42e1c1f5748b3
Opcode Fuzzy Hash: 0c5b9512872b4aeaaa1b5bb0df855a1828bfd12c6f40315308b768f8d07780de
Instruction Fuzzy Hash: A6F0893150031976CB247B62EE0E9593B594B4075CB60807BFD01B50D5DFFDDA45C55E

Function 10002C70 Relevance: 5.2, APIs: 4, Instructions: 181
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003B40: lstrlen.KERNEL32(Address:,00000000,Address:,?,00000000), ref: 10003B9B

lstrlen.KERNEL32(?,?), ref: 10002CC6
Sleep.KERNEL32(00001388), ref: 10002CD8

Part of subcall function 10003B40: lstrlen.KERNEL32(00000000,00000000), ref: 10003BCB

lstrlen.KERNEL32(?,?), ref: 10002D10
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?), ref: 10002EED

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: lstrlen$Sleep
String ID:
API String ID: 429307061-0
Opcode ID: 01160907ffbce50ac604d07a0203dcbb5788cdf2f59fc711bf807c22343a7e53
Instruction ID: d5fc5bc791ea426810ba23de9c023ffc4b3556340b70ead86af3d67a8c1561d7
Opcode Fuzzy Hash: 01160907ffbce50ac604d07a0203dcbb5788cdf2f59fc711bf807c22343a7e53
Instruction Fuzzy Hash: 4D71B4B19083819FD3A1CF78C490B9BBBE5FBC9280F544E2EE189C7255E77095098F52

Function 00401000 Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00401052
_memset.LIBCMT ref: 0040105B
VirtualAlloc.KERNELBASE(?,?,00001000,00000004), ref: 00401070

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: AllocVirtual$_memset
String ID:
API String ID: 1876456587-0
Opcode ID: 9ea9f53229a25d8c650b1b8ed7f1c4ed36205b3c77356b60b482a87fc3536fc8
Instruction ID: e63676adec5951530087f0fb8fcf79db0b4fe774374467a8bd358f17d76d0ca3
Opcode Fuzzy Hash: 9ea9f53229a25d8c650b1b8ed7f1c4ed36205b3c77356b60b482a87fc3536fc8
Instruction Fuzzy Hash: BD1127B1604241ABD324CF19CC80E2AB3E9AF88744F15882EF985AB391C675E8818B65

Function 100046B7 Relevance: 4.5, APIs: 3, Instructions: 38
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 100046D1

Part of subcall function 10003E38: __FF_MSGBANNER.LIBCMT ref: 10003E5B
Part of subcall function 10003E38: __NMSG_WRITE.LIBCMT ref: 10003E62
Part of subcall function 10003E38: RtlAllocateHeap.NTDLL(00000000,?,10026128), ref: 10003EAF

std::bad_alloc::bad_alloc.LIBCMT ref: 100046F4

Part of subcall function 1000469C: std::exception::exception.LIBCMT ref: 100046A8

__CxxThrowException@8.LIBCMT ref: 10004716

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID:
API String ID: 3715980512-0
Opcode ID: 35cf127d170c4c990af0b89054e95575011cf6f1341b00b85e6cb2344320630a
Instruction ID: e74ac3db2ee90786c7bf4d68c08f12ba7414ddb8dcc3aa3f835232b7e0ab6116
Opcode Fuzzy Hash: 35cf127d170c4c990af0b89054e95575011cf6f1341b00b85e6cb2344320630a
Instruction Fuzzy Hash: 1CF027B990014872FB05E361DC0AA9E3BA9CF022D4F124064F900560AAEF62FE15818A

Function 004010B0 Relevance: 3.1, APIs: 2, Instructions: 70
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 004010FF
VirtualProtect.KERNELBASE(?,?,?,?), ref: 00401147

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 8aee70a4b80a8f4cd9e5e87d4158d522970950da06c6967e9dd23a835e404bb0
Instruction ID: 01158a0ebdedfebfb5d0d44fccc68dce859093c6507ccef8acdbf3637957df91
Opcode Fuzzy Hash: 8aee70a4b80a8f4cd9e5e87d4158d522970950da06c6967e9dd23a835e404bb0
Instruction Fuzzy Hash: FE21D2712002019BDB1CCF45D9C0EBBB3A6EB88705F00826DEA46AF2A9E734EC51C764

Function 0043D989 Relevance: 3.1, APIs: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004), ref: 0043D9ED
VirtualProtect.KERNELBASE(?,00001000), ref: 0043DA02

Memory Dump Source

Source File: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 13ec1958b2775ae3cb29b2e3a4e1da5bfdebe1cc9ef8339fd0a728093501d3dd
Instruction ID: 3cf5af0a4a451dbc91a6a9cbf19450f06c46b7ec94353931cab4f936860c543c
Opcode Fuzzy Hash: 13ec1958b2775ae3cb29b2e3a4e1da5bfdebe1cc9ef8339fd0a728093501d3dd
Instruction Fuzzy Hash: 551108B150420A6FF3219770CC45BBB779CEF45355F140555E89AC7286D7A8AC028665

Function 10002F20 Relevance: 3.0, APIs: 2, Instructions: 19networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,0649FEDA), ref: 10002F3D

Part of subcall function 10002C70: lstrlen.KERNEL32(?,?), ref: 10002CC6
Part of subcall function 10002C70: Sleep.KERNEL32(00001388), ref: 10002CD8
Part of subcall function 10002C70: lstrlen.KERNEL32(?,?), ref: 10002D10

WSACleanup.WS2_32 ref: 10002F55

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: lstrlen$CleanupSleepStartup
String ID:
API String ID: 3691655843-0
Opcode ID: 3c51116619be17370c2f62c0e055a7a788bb48348c267f434b620de2a4110bb2
Instruction ID: 89097f0d2a3fe618bf9562b198bc6a7f0dd6a711781521fe435ed2360b44443a
Opcode Fuzzy Hash: 3c51116619be17370c2f62c0e055a7a788bb48348c267f434b620de2a4110bb2
Instruction Fuzzy Hash: 3CE04F74218340CBF325EB64C86AAEA73F4EB8D300F80051DE55AC6285DA3424048A53

Function 100027E3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32(000003A4,00000001,00000000,100027AB), ref: 100027ED
closesocket.WS2_32(00000000), ref: 100027F4

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: ReleaseSemaphoreclosesocket
String ID:
API String ID: 311773542-0
Opcode ID: 0090286a53bc98b97790e446ea57a4ba890dcab6c9abd090a2b2a2eae82e9e55
Instruction ID: 000be27830e383de150e473ed32fb060c2d7733746e1e20562bbecdfefabc882
Opcode Fuzzy Hash: 0090286a53bc98b97790e446ea57a4ba890dcab6c9abd090a2b2a2eae82e9e55
Instruction Fuzzy Hash: DDC09271640220ABFE009BA0CDDDF793A28A749B42F140008FB41CA5AAC6A9B001AB50

Function 0040280C Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00402821

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b5bf22d2a27a4ca0db081a7577504bb9197e07cbcff66427c2e28fb9d92e008d
Instruction ID: a2de30ebf60a6189bb05872ff097659235b16e01a42193b44cc84d8d6f11dce9
Opcode Fuzzy Hash: b5bf22d2a27a4ca0db081a7577504bb9197e07cbcff66427c2e28fb9d92e008d
Instruction Fuzzy Hash: 94D05E766943049ADB109F74AD097723BDC9784395F108436BC0CD6290E674C991C548

Function 10006468 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,100050A1,?), ref: 1000647D

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 0b8f7554f38b72c9dc9189750731cfad9ca360b3fe9d13d691347ee360d7277c
Instruction ID: 1d9f534ba2e8bc4ca5bcb04e26732d852c31fc63c3238f505c461db92e7fc24b
Opcode Fuzzy Hash: 0b8f7554f38b72c9dc9189750731cfad9ca360b3fe9d13d691347ee360d7277c
Instruction Fuzzy Hash: 5AD05E32990355AEF7009F705C497263BDCEB886D5F208435F90CC7550E770D9919500

Non-executed Functions

Function 00402033 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004036C7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004036DC
UnhandledExceptionFilter.KERNEL32(00409160), ref: 004036E7
GetCurrentProcess.KERNEL32(C0000409), ref: 00403703
TerminateProcess.KERNEL32(00000000), ref: 0040370A

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 74eaf3329181d9fd6359935cddf67fa34ebb80c10ed467ea92ab6d32de35f449
Instruction ID: caf0d137d62034d034fbd377ed622dfeb274d68d50f9d1314b73b75b9199ae51
Opcode Fuzzy Hash: 74eaf3329181d9fd6359935cddf67fa34ebb80c10ed467ea92ab6d32de35f449
Instruction Fuzzy Hash: 8621D2B8A00344DFD760EF15F9496553BA4FB88308F82547AE408973B1E7B55986CF4D

Function 10003C98 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 10005493
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100054A8
UnhandledExceptionFilter.KERNEL32(1000F3A0), ref: 100054B3
GetCurrentProcess.KERNEL32(C0000409), ref: 100054CF
TerminateProcess.KERNEL32(00000000), ref: 100054D6

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6b400a94a7e174fc8296cd1196d7fb45991ff6cb4e1887b4cd2380c6544d6975
Instruction ID: f3257386f7bdf2f11a48b8192c0da1a98bb257f5731bb8793f34d3c36609afc2
Opcode Fuzzy Hash: 6b400a94a7e174fc8296cd1196d7fb45991ff6cb4e1887b4cd2380c6544d6975
Instruction Fuzzy Hash: 7521CAB8902A28DFF740DF65CCC5A593BB4FB4C389F71501AE50887676E7B1698A8F01

Function 10001B10 Relevance: 18.1, APIs: 12, Instructions: 128networkCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 10001B8A
getaddrinfo.WS2_32(?,?,?,?), ref: 10001BA4
WSAGetLastError.WS2_32 ref: 10001BAE
socket.WS2_32(?,?,?), ref: 10001BEC
connect.WS2_32(00000000,?,?), ref: 10001C02
WSAGetLastError.WS2_32 ref: 10001C0D
closesocket.WS2_32(00000000), ref: 10001C12
FreeAddrInfoW.WS2_32(?), ref: 10001C27
getpeername.WS2_32 ref: 10001C45

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: ErrorLast$AddrFreeInfo_sprintfclosesocketconnectgetaddrinfogetpeernamesocket
String ID:
API String ID: 357618637-0
Opcode ID: f968d07bf09401d4ca905c482a2d55f29134073bd25110e3d75c48fe33f8a3af
Instruction ID: 7e8f8d7498ded9ed1de97ff87a1976872bbbe75f0ba1644668d4659acd03c211
Opcode Fuzzy Hash: f968d07bf09401d4ca905c482a2d55f29134073bd25110e3d75c48fe33f8a3af
Instruction Fuzzy Hash: CC410C765083109FE350DF69C88496BBBF4FF897A0F414A1EF5A5C7294E731A805CB92

Function 10002240 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10002320

Part of subcall function 10003E38: __FF_MSGBANNER.LIBCMT ref: 10003E5B
Part of subcall function 10003E38: __NMSG_WRITE.LIBCMT ref: 10003E62
Part of subcall function 10003E38: RtlAllocateHeap.NTDLL(00000000,?,10026128), ref: 10003EAF

_malloc.LIBCMT ref: 10002376
_malloc.LIBCMT ref: 100023EA

Part of subcall function 10003D5B: __lock.LIBCMT ref: 10003D79
Part of subcall function 10003D5B: ___sbh_find_block.LIBCMT ref: 10003D84
Part of subcall function 10003D5B: ___sbh_free_block.LIBCMT ref: 10003D93
Part of subcall function 10003D5B: HeapFree.KERNEL32(00000000,?,10011280,0000000C,10006669,00000000,10011360,0000000C,100066A3,?,?,?,1000C102,00000004,100116D0,0000000C), ref: 10003DC3
Part of subcall function 10003D5B: GetLastError.KERNEL32(?,1000C102,00000004,100116D0,0000000C,1000807C,?,?,00000000,00000000,00000000,?,10007C8F,00000001,00000214), ref: 10003DD4

Part of subcall function 10001D20: send.WS2_32(100260FC,?,?,00000000), ref: 10001D52

Strings

71710533-BEBA-4937-8319-B5DBEF9CCC36, xrefs: 100023F4
8a885d04-1ceb-11c9-9fe8-08002b104860, xrefs: 100023AF
e1af8308-5d1f-11c9-91a4-08002b14a0fa, xrefs: 10002351, 100023C6

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: _malloc$Heap$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__locksend
String ID: 71710533-BEBA-4937-8319-B5DBEF9CCC36$8a885d04-1ceb-11c9-9fe8-08002b104860$e1af8308-5d1f-11c9-91a4-08002b14a0fa
API String ID: 2460757428-940264259
Opcode ID: 7d8f45697e78ba840e60a0b0d9500a8298e42e62d6465d2c4fc28f103fd5005a
Instruction ID: 1b264b112344a286b62f08fe979abe4cd66a8de88587c9658907f773bab837f3
Opcode Fuzzy Hash: 7d8f45697e78ba840e60a0b0d9500a8298e42e62d6465d2c4fc28f103fd5005a
Instruction Fuzzy Hash: 7D5106B56083805BF704DF388845BAFB7D9EFA4380F44452EF48597256EA71EA0883A7

Function 100010C0 Relevance: 9.1, APIs: 6, Instructions: 59networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 100010E2
inet_addr.WS2_32(?), ref: 100010F5
htons.WS2_32(000001BD), ref: 10001104
connect.WS2_32(00000000,00000001,00000010), ref: 10001117
setsockopt.WS2_32(00000000,0000FFFF,00001005,00000000,00000004), ref: 1000114F
setsockopt.WS2_32(00000000,0000FFFF,00001006,00000000,00000004), ref: 10001163

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: setsockopt$connecthtonsinet_addrsocket
String ID:
API String ID: 634521338-0
Opcode ID: d3b95098eae85f92cc2476d2bb1e084d350538fbf2a38f146124337732d3d3eb
Instruction ID: ab90d36bf04ab1ab28792a5d4df5801b2f3dc8b99b634369fc7100644e842882
Opcode Fuzzy Hash: d3b95098eae85f92cc2476d2bb1e084d350538fbf2a38f146124337732d3d3eb
Instruction Fuzzy Hash: 89118271604311ABF600EF64CC4AFABB3A4EF99B50F40451EF250DB1D4EBB0990487D2

Function 10008F65 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10008F8D

Part of subcall function 10004CCF: __getptd.LIBCMT ref: 10004CDD
Part of subcall function 10004CCF: __getptd.LIBCMT ref: 10004CEB

__getptd.LIBCMT ref: 10008F97

Part of subcall function 10007CDD: __getptd_noexit.LIBCMT ref: 10007CE0
Part of subcall function 10007CDD: __amsg_exit.LIBCMT ref: 10007CED

__getptd.LIBCMT ref: 10008FA5
__getptd.LIBCMT ref: 10008FB3
__getptd.LIBCMT ref: 10008FBE
_CallCatchBlock2.LIBCMT ref: 10008FE4

Part of subcall function 10004D74: __CallSettingFrame@12.LIBCMT ref: 10004DC0

Part of subcall function 1000908B: __getptd.LIBCMT ref: 1000909A
Part of subcall function 1000908B: __getptd.LIBCMT ref: 100090A8

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 19366457f99eb2ba43ca3174e5077224196aaae41fcdb5ab2905588aface0ea8
Instruction ID: 6d1943aa09054af6d3efea09979b7d6c6cd0ea7393e0e7a84452e89f10ae19de
Opcode Fuzzy Hash: 19366457f99eb2ba43ca3174e5077224196aaae41fcdb5ab2905588aface0ea8
Instruction Fuzzy Hash: 951119B5D00209DFEF10DFA4C845AEE7BB1FF08350F10806AF818A7255DB38AA119F50

Function 100024E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 100010C0: socket.WS2_32 ref: 100010E2
Part of subcall function 100010C0: inet_addr.WS2_32(?), ref: 100010F5
Part of subcall function 100010C0: htons.WS2_32(000001BD), ref: 10001104
Part of subcall function 100010C0: connect.WS2_32(00000000,00000001,00000010), ref: 10001117

_memset.LIBCMT ref: 10002532

Part of subcall function 100012A0: _sprintf.LIBCMT ref: 100012E2

_printf.LIBCMT ref: 1000259C
closesocket.WS2_32(00000000), ref: 100025A6

Strings

%s, xrefs: 10002597
@, xrefs: 10002558

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: _memset_printf_sprintfclosesocketconnecthtonsinet_addrsocket
String ID: %s$@
API String ID: 2892013958-1009417723
Opcode ID: 05d5b3fe2b97e3e3bbc0ae5e31354cb5376aa4e690a165740468e6de7c4511cd
Instruction ID: d4af0a1e68df37c053bb49c4e0b2bba6255989cedd96f643f4383941705f3779
Opcode Fuzzy Hash: 05d5b3fe2b97e3e3bbc0ae5e31354cb5376aa4e690a165740468e6de7c4511cd
Instruction Fuzzy Hash: C211E2B99002516EF214DB549C62FFB77ECDFDA7C1F84000EB98492186DEB46C0486B3

Function 10008CB4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10008CCE

Part of subcall function 10007CDD: __getptd_noexit.LIBCMT ref: 10007CE0
Part of subcall function 10007CDD: __amsg_exit.LIBCMT ref: 10007CED

__getptd.LIBCMT ref: 10008CDF
__getptd.LIBCMT ref: 10008CED

Strings

csm, xrefs: 10008CC7
MOC, xrefs: 10008CC0

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ce0845d09b459957a6131062b91d2626aaf8542dd5e476fb99f5610ff2b4b54b
Instruction ID: 7809ab124c588d1158f3cb55494da3994a5d9686434fad794acb1d46434c16bf
Opcode Fuzzy Hash: ce0845d09b459957a6131062b91d2626aaf8542dd5e476fb99f5610ff2b4b54b
Instruction Fuzzy Hash: 26E01A35A102048FF710DA64C046F5837E5FB45294F1A04B6A84D87227EB38ED809752

Function 00405B6B Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00405B77

Part of subcall function 00404D0A: __getptd_noexit.LIBCMT ref: 00404D0D
Part of subcall function 00404D0A: __amsg_exit.LIBCMT ref: 00404D1A

__amsg_exit.LIBCMT ref: 00405B97
__lock.LIBCMT ref: 00405BA7
InterlockedDecrement.KERNEL32(?), ref: 00405BC4
InterlockedIncrement.KERNEL32(008F15B8), ref: 00405BEF

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 5d560d5e219a44ebe9575ff2ac032521f62673b64380f380069cb4ef5b654b61
Instruction ID: 4c81c9d17ccd454affcda5f3cacb665ea388d5e4f540c941b66f788eaca92c42
Opcode Fuzzy Hash: 5d560d5e219a44ebe9575ff2ac032521f62673b64380f380069cb4ef5b654b61
Instruction Fuzzy Hash: 4C018B31A01A219BDB21AF269806B5B7B70EF04720F11003BE804B76D1D73CB982DF9E

Function 10009BD2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10009BDE

Part of subcall function 10007CDD: __getptd_noexit.LIBCMT ref: 10007CE0
Part of subcall function 10007CDD: __amsg_exit.LIBCMT ref: 10007CED

__amsg_exit.LIBCMT ref: 10009BFE
__lock.LIBCMT ref: 10009C0E
InterlockedDecrement.KERNEL32(?), ref: 10009C2B
InterlockedIncrement.KERNEL32(010215B0), ref: 10009C56

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: b915ef19fc6a9f41bbe35c694cdedad18e2c2be3ee345302b021820979a56828
Instruction ID: 56dbaf77e5e653750c3cd1570e9a0eb410f20252ce2cb0aabad9b1a03835aedb
Opcode Fuzzy Hash: b915ef19fc6a9f41bbe35c694cdedad18e2c2be3ee345302b021820979a56828
Instruction Fuzzy Hash: 4801C035E00B21DBFB15DB648845B9DB3E0FB047E1F210109E815A7699CB347981CBD5

Function 10003D5B Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 10003D79

Part of subcall function 10006688: __mtinitlocknum.LIBCMT ref: 1000669E
Part of subcall function 10006688: __amsg_exit.LIBCMT ref: 100066AA
Part of subcall function 10006688: RtlEnterCriticalSection.NTDLL(?), ref: 100066B2

___sbh_find_block.LIBCMT ref: 10003D84
___sbh_free_block.LIBCMT ref: 10003D93
HeapFree.KERNEL32(00000000,?,10011280,0000000C,10006669,00000000,10011360,0000000C,100066A3,?,?,?,1000C102,00000004,100116D0,0000000C), ref: 10003DC3
GetLastError.KERNEL32(?,1000C102,00000004,100116D0,0000000C,1000807C,?,?,00000000,00000000,00000000,?,10007C8F,00000001,00000214), ref: 10003DD4

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: a9a395c8c64a107b5fc1c2160f3f281149e6e6503692b2d94fd83d603c7333e0
Instruction ID: 0fdef51ea46211b2d51c7f9bff59d1d218ba4b39f8528bb6811944a6984ed9a1
Opcode Fuzzy Hash: a9a395c8c64a107b5fc1c2160f3f281149e6e6503692b2d94fd83d603c7333e0
Instruction Fuzzy Hash: C5018B35C01315EAFB11EF70AC0A79F7BA9EF047D1F31811AF5459B089CB35A5458654

Function 10002AE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 10002B4C
_sprintf.LIBCMT ref: 10002B8B

Strings

%s.255.255.255, xrefs: 10002B46
%s.0.0, xrefs: 10002B85

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: _sprintf
String ID: %s.0.0$%s.255.255.255
API String ID: 1467051239-1053531112
Opcode ID: 4f2ac01ae8be9c4431755ba7d6c936ae993ec5da5ec11a115016891261e06e42
Instruction ID: a519e05f2fe54f7add88102434084c9316df7528b642c8c9220708b95a929b21
Opcode Fuzzy Hash: 4f2ac01ae8be9c4431755ba7d6c936ae993ec5da5ec11a115016891261e06e42
Instruction Fuzzy Hash: EE218EB69083019FE340CF28D881A2BFBE4EBDD394F01492EF489D7205E33199858B93

Function 10002BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 10002C37
_sprintf.LIBCMT ref: 10002C47

Strings

%s.0.0, xrefs: 10002C31
%s.255.255, xrefs: 10002C41

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: _sprintf
String ID: %s.0.0$%s.255.255
API String ID: 1467051239-1567914622
Opcode ID: c018d199947458774f7ce6909992630254bf6f0e3653987aaa2f1e6ca8ed30d9
Instruction ID: 041d2dc49f0b6771e44957195327b058b30ad1a4d2cc1533408bab12129d8427
Opcode Fuzzy Hash: c018d199947458774f7ce6909992630254bf6f0e3653987aaa2f1e6ca8ed30d9
Instruction Fuzzy Hash: 3B1163B6A083409FE344DF29D881A6FB7E8FBDD254F41492EF58AD7105E730A548CB92

Function 1000D2F3 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1000D327
__isleadbyte_l.LIBCMT ref: 1000D35B
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,?,00000000,?,?,?,00000000,00000000,?,00000000), ref: 1000D38C
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,?,00000000,?,?,?,00000000,00000000,?,00000000), ref: 1000D3FA

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5a47aeb3ec1418e5aae054357b6cfee90229b4a90af095f4c232afe9eb4ff0ee
Instruction ID: 9cadf880092d749cd6c24657f12800e5706c3f1949b301bbcc580d3d2adc48e4
Opcode Fuzzy Hash: 5a47aeb3ec1418e5aae054357b6cfee90229b4a90af095f4c232afe9eb4ff0ee
Instruction Fuzzy Hash: E031B235A14256EFEB10EF64C894AAE7BE5EF022D0F11856AE4649B099D330DE40DB72

Function 10003B40 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10003890: InternetOpenA.WININET ref: 100038F6

lstrlen.KERNEL32(Address:,00000000,Address:,?,00000000), ref: 10003B9B
lstrlen.KERNEL32(00000000,00000000), ref: 10003BCB

Part of subcall function 10003D5B: __lock.LIBCMT ref: 10003D79
Part of subcall function 10003D5B: ___sbh_find_block.LIBCMT ref: 10003D84
Part of subcall function 10003D5B: ___sbh_free_block.LIBCMT ref: 10003D93
Part of subcall function 10003D5B: HeapFree.KERNEL32(00000000,?,10011280,0000000C,10006669,00000000,10011360,0000000C,100066A3,?,?,?,1000C102,00000004,100116D0,0000000C), ref: 10003DC3
Part of subcall function 10003D5B: GetLastError.KERNEL32(?,1000C102,00000004,100116D0,0000000C,1000807C,?,?,00000000,00000000,00000000,?,10007C8F,00000001,00000214), ref: 10003DD4

Strings

Address:, xrefs: 10003B81, 10003B94
http://ddns.oray.com/checkip, xrefs: 10003B4B

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: lstrlen$ErrorFreeHeapInternetLastOpen___sbh_find_block___sbh_free_block__lock
String ID: Address:$http://ddns.oray.com/checkip
API String ID: 2038665243-222288032
Opcode ID: c94f2c0336589478cef8ae3a7beeca418366219fc1af6587b963cb0fa16e63f9
Instruction ID: b3eeba61140a080fe8e78d16e387a2ae3afa7c0b2c26dc89ca9f2848b0f18f38
Opcode Fuzzy Hash: c94f2c0336589478cef8ae3a7beeca418366219fc1af6587b963cb0fa16e63f9
Instruction Fuzzy Hash: EA21F672A053515BF202D628AC61FBFB7CCEF851D4F08C52AFA4087209DB21ED09C3A2

Function 10003780 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 100037DD
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 1000380F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 10003824
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 10003847

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: da92fafbb9ba83b0f0886caa2b06039511dc03d38100daf76f2d04a94b275ac6
Instruction ID: 5b544edf82f3b4c3dd79cdfd94dbab36414e52d3f04fc1d8dd2057ffd936ece6
Opcode Fuzzy Hash: da92fafbb9ba83b0f0886caa2b06039511dc03d38100daf76f2d04a94b275ac6
Instruction Fuzzy Hash: F231E5B5644340BFE310CF258C46F27BBECE749B60F10462EFA25D62C5DA71B5088675

Function 004013C0 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0040140F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00401434
GetProcessHeap.KERNEL32(00000000,?), ref: 0040143D
HeapFree.KERNEL32(00000000), ref: 00401444

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtual
String ID:
API String ID: 548792435-0
Opcode ID: a54b5111ae4721cc738e9c418911ec0a2c1c12ca1a5b7648992d340e476ddf7f
Instruction ID: 44b6dcb9f8fa0d770172e878e483460487ee9956fb5d21b62aa35cac5de5b57c
Opcode Fuzzy Hash: a54b5111ae4721cc738e9c418911ec0a2c1c12ca1a5b7648992d340e476ddf7f
Instruction Fuzzy Hash: 7C115A71640711ABD2308F65CC84B57B3E8BB88711F14892AE59AA72F1C778F881CB58

Function 004062D7 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004062E3

Part of subcall function 00404D0A: __getptd_noexit.LIBCMT ref: 00404D0D
Part of subcall function 00404D0A: __amsg_exit.LIBCMT ref: 00404D1A

__getptd.LIBCMT ref: 004062FA
__amsg_exit.LIBCMT ref: 00406308
__lock.LIBCMT ref: 00406318

Memory Dump Source

Source File: 0000000A.00000002.4141096184.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.4141070938.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.0000000000409000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000040C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141096184.000000000043C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141197300.000000000043D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.4141215396.000000000043E000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_HelpSystem.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 524faea45244a268c062c5184f2be0e94cf2fd0199a80f3924abc133d0648528
Instruction ID: f4e1f9b372ad46e3e63869bb60c71836a386fc819cd7756a748b17d8f7b0d52d
Opcode Fuzzy Hash: 524faea45244a268c062c5184f2be0e94cf2fd0199a80f3924abc133d0648528
Instruction Fuzzy Hash: D9F06231A00700CAE621BFA6A50775973A46F40725F12417FE8017B2D1CB7C99518A9A

Function 1000A33E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000A34A

Part of subcall function 10007CDD: __getptd_noexit.LIBCMT ref: 10007CE0
Part of subcall function 10007CDD: __amsg_exit.LIBCMT ref: 10007CED

__getptd.LIBCMT ref: 1000A361
__amsg_exit.LIBCMT ref: 1000A36F
__lock.LIBCMT ref: 1000A37F

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 4884e0b45204d1cfb58c31165a06c012d45a0b18908b0aa078a58503ff58d253
Instruction ID: 3b4ab1aef9f716a3281e031d6d028c1aabcf37f9b90a6b423d083108cdc385d8
Opcode Fuzzy Hash: 4884e0b45204d1cfb58c31165a06c012d45a0b18908b0aa078a58503ff58d253
Instruction Fuzzy Hash: 62F03035E407149BF761DB748402B8D73A0FF057E1F614319F4969B2DADB38BA818A52

Function 100012A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 100012E2

Part of subcall function 100010A0: recv.WS2_32(74D75E50,00000000,?,00000000), ref: 100010B1

Strings

???, xrefs: 10001334
\\%s\IPC$, xrefs: 100012C9

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: _sprintfrecv
String ID: ???$\\%s\IPC$
API String ID: 2425787784-2720798200
Opcode ID: 91ab3bcc641255235107154f623fcbffeb4870ceb257c60141859b45d50a3968
Instruction ID: 8626a2ac0646a49ed062067d8ff73052644c3eb87cdfbe324cca27f62a988a16
Opcode Fuzzy Hash: 91ab3bcc641255235107154f623fcbffeb4870ceb257c60141859b45d50a3968
Instruction Fuzzy Hash: E721E4751043859FE321CB28C891BEBB7D9EBC8380F44C82DF689C7255EA74A909C756

Function 1000908B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10004D22: __getptd.LIBCMT ref: 10004D28
Part of subcall function 10004D22: __getptd.LIBCMT ref: 10004D38

__getptd.LIBCMT ref: 1000909A

Part of subcall function 10007CDD: __getptd_noexit.LIBCMT ref: 10007CE0
Part of subcall function 10007CDD: __amsg_exit.LIBCMT ref: 10007CED

__getptd.LIBCMT ref: 100090A8

Strings

csm, xrefs: 100090B6

Memory Dump Source

Source File: 0000000A.00000002.4143694144.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.4143678897.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.0000000010013000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143694144.000000001002B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.4143750862.000000001002D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_HelpSystem.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 1e63982ee4927c94cf36002735b621a62016c2f8b061fef16a69a95215cd6f65
Instruction ID: 1915a74a9d082d973d19f17d6b88a180184f81430aa84b0b331a2a433b51b776
Opcode Fuzzy Hash: 1e63982ee4927c94cf36002735b621a62016c2f8b061fef16a69a95215cd6f65
Instruction Fuzzy Hash: 94014638A012068EFB24CF60C844B9DB3F5FF48291F21442EE4829A299DF76AD80CF41

Analysis Process: Network64.exePID: 2996, Parent PID: 7380COMMON

Execution Graph

Execution Coverage:	51.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Non-executed Functions

Function 00812B00 Relevance: 7.6, APIs: 5, Instructions: 56
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00812B45
GetCurrentProcessId.KERNEL32 ref: 00812B50
GetCurrentThreadId.KERNEL32 ref: 00812B59
GetTickCount.KERNEL32 ref: 00812B61
QueryPerformanceCounter.KERNEL32 ref: 00812B6E

Memory Dump Source

Source File: 0000000C.00000002.4141120724.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.4141100654.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4141810196.00000000009DA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4141828793.00000000009DB000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4141851861.00000000009DF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4141872839.00000000009EA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4142185836.0000000000BAD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4142185836.0000000000BBF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4142185836.0000000000C44000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4142277512.0000000000C48000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.4142277512.0000000000C4D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_Network64.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 2e0eb8e543fe4f6079a450de9d971f31e3d4bc826408ef24634c57837d35a535
Instruction ID: ac116df8242bf511535ce9b7dacce59cab9ddd66f02cbb52400d8b8dee669a59
Opcode Fuzzy Hash: 2e0eb8e543fe4f6079a450de9d971f31e3d4bc826408ef24634c57837d35a535
Instruction Fuzzy Hash: DA119E66729B5482FB208B21F8147597364BB48BB0F081B309E9D837B8DB3CC886C700

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report R4WCgDAfHB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Bitcoin Miner

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Network\HelpSystem.exe

C:\Program Files (x86)\Microsoft Network\Network64.exe

C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\checkip[1].htm

C:\Windows\SystemNvwmiShell\NvwmiShell.dll

C:\Windows\SystemNvwmiShell\NvwmiShell.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
R4WCgDAfHB.exe

Function 00882175 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryCOMMON

Function 00881740 Relevance: 42.2, APIs: 2, Strings: 26, Instructions: 164
stringCOMMON

Function 008824BE Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 158
libraryloaderCOMMON

Function 0088EAB7 Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Function 0088C2D7 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 122
COMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre