Edit tour

Windows Analysis Report
unturnedHack.exe

Overview

General Information

Sample name:	unturnedHack.exe
Analysis ID:	1561488
MD5:	c5293ff604e4231fdffaa092fd7c5ca8
SHA1:	9e8aeb9ec19b8a6d534360883188872a257bb337
SHA256:	4531a1efd815df17d3a6f247d0850ab5e510de2345723e41c062716e65df686e
Tags:	exeuser-4k95m
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

unturnedHack.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\unturnedHack.exe" MD5: C5293FF604E4231FDFFAA092FD7C5CA8)

unturnedHack.exe (PID: 6668 cmdline: "C:\Users\user\Desktop\unturnedHack.exe" MD5: C5293FF604E4231FDFFAA092FD7C5CA8)

cmd.exe (PID: 2736 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3448 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "109.107.181.162", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "761", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: unturnedHack.exe PID: 6668	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: unturnedHack.exe PID: 6668	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.unturnedHack.exe.140000000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
1.2.unturnedHack.exe.140000000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\unturnedHack.exe", ParentImage: C:\Users\user\Desktop\unturnedHack.exe, ParentProcessId: 6668, ParentProcessName: unturnedHack.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe", ProcessId: 2736, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:57:04.545569+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	109.107.181.162	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:57:04.545569+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	109.107.181.162	15666	TCP
2024-11-23T14:57:04.668026+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	109.107.181.162	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:57:04.545569+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	109.107.181.162	15666	TCP
2024-11-23T14:57:04.668026+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	109.107.181.162	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.unturnedHack.exe.140000000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "109.107.181.162", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "761", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: unturnedHack.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140074DB0 CryptUnprotectData,LocalFree,	1_2_0000000140074DB0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140112090 CryptUnprotectData,	1_2_0000000140112090
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400750D0 CryptProtectData,LocalFree,	1_2_00000001400750D0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140038910 CryptUnprotectData,LocalFree,	1_2_0000000140038910

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: unturnedHack.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400EB530 FindClose,FindFirstFileExW,GetLastError,	1_2_00000001400EB530
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400EB5E0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	1_2_00000001400EB5E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140037AA0 FindFirstFileW,FindNextFileW,	1_2_0000000140037AA0

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_0000000140084A60 GetLogicalDriveStringsW,

1_2_0000000140084A60

Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 109.107.181.162:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 109.107.181.162:15666

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 109.107.181.162:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 109.107.181.162 109.107.181.162
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: TELEPORT-TV-ASRU TELEPORT-TV-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 109.107.181.162:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_0000000140082890 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

1_2_0000000140082890

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unturnedHack.exe, 00000001.00000003.1695750238.000002A22FF41000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1942978080.000002A22FF54000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1942952611.000002A22FF50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1696833003.000002A23067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1696833003.000002A23067E000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697272919.000002A23067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1696833003.000002A23067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: unturnedHack.exe, 00000001.00000003.1705344411.000002A230798000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1702320125.000002A230976000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705533318.000002A2306C4000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB8B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB83000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB0C000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB04000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FAB8000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705344411.000002A230790000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705452295.000002A230750000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705533318.000002A2306BC000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FAB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697955109.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697638188.000002A230695000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697942439.000002A22F9A3000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697819366.000002A230659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697955109.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697638188.000002A230695000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697942439.000002A22F9A3000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697819366.000002A230659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: unturnedHack.exe, 00000001.00000003.1705344411.000002A230798000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1702320125.000002A230976000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705533318.000002A2306C4000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB8B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB83000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB0C000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB04000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FAB8000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705344411.000002A230790000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705452295.000002A230750000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705533318.000002A2306BC000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FAB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FABF000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705344411.000002A2307A0000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1703473243.000002A230DC2000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB14000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: unturnedHack.exe, 00000001.00000003.1700589020.000002A22FABF000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705344411.000002A2307A0000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1703473243.000002A230DC2000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB14000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400831C0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_00000001400831C0

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140088390 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	1_2_0000000140088390
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140112728 NtAllocateVirtualMemory,	1_2_0000000140112728
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140087C90 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	1_2_0000000140087C90

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C2000	1_2_00000001400C2000
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C3180	1_2_00000001400C3180
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400831C0	1_2_00000001400831C0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140064200	1_2_0000000140064200
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014003E240	1_2_000000014003E240
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140032260	1_2_0000000140032260
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400F2268	1_2_00000001400F2268
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014005D2B0	1_2_000000014005D2B0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014003F2E0	1_2_000000014003F2E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140045430	1_2_0000000140045430
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400AA588	1_2_00000001400AA588
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400EB5E0	1_2_00000001400EB5E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014007C5E0	1_2_000000014007C5E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400856A0	1_2_00000001400856A0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400796D0	1_2_00000001400796D0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014003D6E0	1_2_000000014003D6E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C4890	1_2_00000001400C4890
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140082890	1_2_0000000140082890
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014003F890	1_2_000000014003F890
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014008C9C0	1_2_000000014008C9C0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140034A50	1_2_0000000140034A50
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140037AA0	1_2_0000000140037AA0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140031B70	1_2_0000000140031B70
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400CDBC0	1_2_00000001400CDBC0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140084D10	1_2_0000000140084D10
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140083EC0	1_2_0000000140083EC0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140079F00	1_2_0000000140079F00
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140008000	1_2_0000000140008000
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140051070	1_2_0000000140051070
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014008C090	1_2_000000014008C090
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400730F0	1_2_00000001400730F0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140058150	1_2_0000000140058150
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400701A0	1_2_00000001400701A0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014006F200	1_2_000000014006F200
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014009F268	1_2_000000014009F268
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400782D0	1_2_00000001400782D0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400592D0	1_2_00000001400592D0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400B32E0	1_2_00000001400B32E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140088390	1_2_0000000140088390
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014009F384	1_2_000000014009F384
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140007460	1_2_0000000140007460
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400EE4B0	1_2_00000001400EE4B0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400CE500	1_2_00000001400CE500
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014006F500	1_2_000000014006F500
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C4530	1_2_00000001400C4530
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400DB540	1_2_00000001400DB540
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014004F570	1_2_000000014004F570
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400735A6	1_2_00000001400735A6
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014003A5AD	1_2_000000014003A5AD
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400675D0	1_2_00000001400675D0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014005C6B0	1_2_000000014005C6B0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400296B0	1_2_00000001400296B0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400886E0	1_2_00000001400886E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140075760	1_2_0000000140075760
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014009D7E0	1_2_000000014009D7E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400277F0	1_2_00000001400277F0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140026800	1_2_0000000140026800
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014009B810	1_2_000000014009B810
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014006B810	1_2_000000014006B810
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400AA804	1_2_00000001400AA804
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400DA820	1_2_00000001400DA820
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014006F830	1_2_000000014006F830
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400DA840	1_2_00000001400DA840
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140032890	1_2_0000000140032890
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014007B8B0	1_2_000000014007B8B0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400078F0	1_2_00000001400078F0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400949B4	1_2_00000001400949B4
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400799C3	1_2_00000001400799C3
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C89E0	1_2_00000001400C89E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140098ABC	1_2_0000000140098ABC
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400A8B08	1_2_00000001400A8B08
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400CFB20	1_2_00000001400CFB20
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014006FB50	1_2_000000014006FB50
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140038B60	1_2_0000000140038B60
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400CAB70	1_2_00000001400CAB70
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140083BA0	1_2_0000000140083BA0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C1BC0	1_2_00000001400C1BC0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400F1BCC	1_2_00000001400F1BCC
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400C6C00	1_2_00000001400C6C00
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400CBC80	1_2_00000001400CBC80
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140032C90	1_2_0000000140032C90
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140072CB0	1_2_0000000140072CB0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140098CC0	1_2_0000000140098CC0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400A1CB8	1_2_00000001400A1CB8
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014004DDA0	1_2_000000014004DDA0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140005DC0	1_2_0000000140005DC0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140096DF0	1_2_0000000140096DF0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400AADF4	1_2_00000001400AADF4
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400ABE30	1_2_00000001400ABE30
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_000000014006FE70	1_2_000000014006FE70
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140050E80	1_2_0000000140050E80
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140094EC0	1_2_0000000140094EC0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140098EC4	1_2_0000000140098EC4
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140071F40	1_2_0000000140071F40
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140052F80	1_2_0000000140052F80

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: String function: 000000014002E1B0 appears 32 times
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: String function: 0000000140030910 appears 31 times

Source: unturnedHack.exe

Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/1@1/2

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140089910 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		1_2_0000000140089910
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140112008 AdjustTokenPrivileges,CredEnumerateA,		1_2_0000000140112008

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_000000014003F2E0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_000000014003F2E0

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_000000014007209A CoCreateInstance,

1_2_000000014007209A

Source: C:\Users\user\Desktop\unturnedHack.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963F7A8ECA9
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2800:120:WilError_03

Source: unturnedHack.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\unturnedHack.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\unturnedHack.exe "C:\Users\user\Desktop\unturnedHack.exe"
Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: C:\Users\user\Desktop\unturnedHack.exe "C:\Users\user\Desktop\unturnedHack.exe"
Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: C:\Users\user\Desktop\unturnedHack.exe "C:\Users\user\Desktop\unturnedHack.exe"	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: unturnedHack.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: unturnedHack.exe

Static file information: File size 4269056 > 1048576

Source: unturnedHack.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x38c000

Source: unturnedHack.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: unturnedHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: unturnedHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: unturnedHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: unturnedHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: unturnedHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_000000014003E240 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_000000014003E240

Source: unturnedHack.exe	Static PE information: section name: .00cfg
Source: unturnedHack.exe	Static PE information: section name: .gxfg
Source: unturnedHack.exe	Static PE information: section name: .retplne
Source: unturnedHack.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_000000014006B0F9 push rcx; iretd

1_2_000000014006B0FC

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400796D0 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

1_2_00000001400796D0

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe"
Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe"			Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-50677

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400EB530 FindClose,FindFirstFileExW,GetLastError,	1_2_00000001400EB530
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400EB5E0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	1_2_00000001400EB5E0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140037AA0 FindFirstFileW,FindNextFileW,	1_2_0000000140037AA0

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_0000000140084A60 GetLogicalDriveStringsW,

1_2_0000000140084A60

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400C83D0 GetSystemInfo,LoadLibraryA,GetProcAddress,GetCurrentProcess,VirtualAlloc2,

1_2_00000001400C83D0

Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: unturnedHack.exe	Binary or memory string: VBoxGuest
Source: unturnedHack.exe	Binary or memory string: VBoxMouse
Source: unturnedHack.exe	Binary or memory string: VBoxTray
Source: unturnedHack.exe	Binary or memory string: VBoxMRXNP
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DCCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: unturnedHack.exe, 00000001.00000003.1696203175.000002A22DCFA000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000002.1943610876.000002A22DCF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: unturnedHack.exe	Binary or memory string: VBoxHook
Source: unturnedHack.exe	Binary or memory string: VBoxSF

Source: C:\Users\user\Desktop\unturnedHack.exe	API call chain: ExitProcess graph end node			graph_1-50524
Source: C:\Users\user\Desktop\unturnedHack.exe	API call chain: ExitProcess graph end node			graph_1-50519

Source: C:\Users\user\Desktop\unturnedHack.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_0000000140088390 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

1_2_0000000140088390

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_0000000140112300 IsDebuggerPresent,

1_2_0000000140112300

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400EDBBC GetLastError,IsDebuggerPresent,OutputDebugStringW,

1_2_00000001400EDBBC

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_000000014003E240 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_000000014003E240

Source: C:\Users\user\Desktop\unturnedHack.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_0000000140112310 SetUnhandledExceptionFilter,		1_2_0000000140112310
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: 1_2_00000001400938D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_00000001400938D8

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\unturnedHack.exe

Memory written: C:\Users\user\Desktop\unturnedHack.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\unturnedHack.exe

Thread register set: target process: 6668

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400782D0 ShellExecuteW,

1_2_00000001400782D0

Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: C:\Users\user\Desktop\unturnedHack.exe "C:\Users\user\Desktop\unturnedHack.exe"	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: GetLocaleInfoEx,FormatMessageA,	1_2_00000001400EB1A0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00000001400B0350
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: GetLocaleInfoW,	1_2_00000001401123D0
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: GetLocaleInfoW,	1_2_00000001400A5418
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: EnumSystemLocalesW,	1_2_00000001400B06AC
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: EnumSystemLocalesW,	1_2_00000001400B077C
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00000001400B0BB4
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00000001400B0D98
Source: C:\Users\user\Desktop\unturnedHack.exe	Code function: EnumSystemLocalesW,	1_2_00000001400A4ED8

Source: C:\Users\user\Desktop\unturnedHack.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 0_2_00007FF6C0A0FDE4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6C0A0FDE4

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400837A0 GetUserNameW,

1_2_00000001400837A0

Source: C:\Users\user\Desktop\unturnedHack.exe

Code function: 1_2_00000001400AA588 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

1_2_00000001400AA588

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: unturnedHack.exe PID: 6668, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 1.2.unturnedHack.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.unturnedHack.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unturnedHack.exe PID: 6668, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DCCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: KHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: unturnedHack.exe, 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\unturnedHack.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\unturnedHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\unturnedHack.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: unturnedHack.exe PID: 6668, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 1.2.unturnedHack.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.unturnedHack.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unturnedHack.exe PID: 6668, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 File Deletion	NTDS	25 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	211 Process Injection	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	11 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
unturnedHack.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1696833003.000002A23067E000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697272919.000002A23067F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1696833003.000002A23067E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697638188.000002A230695000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697942439.000002A22F9A3000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697819366.000002A230659000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1696833003.000002A23067E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org	unturnedHack.exe, 00000001.00000003.1705344411.000002A230798000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1702320125.000002A230976000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705533318.000002A2306C4000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB8B000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB83000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB0C000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB04000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FAB8000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705344411.000002A230790000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705452295.000002A230750000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1705533318.000002A2306BC000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1700589020.000002A22FAB0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697955109.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697638188.000002A230695000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697942439.000002A22F9A3000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697819366.000002A230659000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	unturnedHack.exe, 00000001.00000003.1697819366.000002A23067D000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697955109.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ns.microsoft.t/Regi	unturnedHack.exe, 00000001.00000003.1695750238.000002A22FF41000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1942978080.000002A22FF54000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1942952611.000002A22FF50000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	unturnedHack.exe, 00000001.00000003.1697272919.000002A230697000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1697076524.000002A22DD0B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	unturnedHack.exe, 00000001.00000003.1700589020.000002A22FB93000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	unturnedHack.exe, 00000001.00000003.1706043718.000002A22DD0A000.00000004.00000020.00020000.00000000.sdmp, unturnedHack.exe, 00000001.00000003.1706023274.000002A22F9A4000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.107.181.162	unknown	Russian Federation		49973	TELEPORT-TV-ASRU	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561488
Start date and time:	2024-11-23 14:56:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	unturnedHack.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/1@1/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 61% Number of executed functions: 81 Number of non-executed functions: 106
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target unturnedHack.exe, PID 6592 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: unturnedHack.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.107.181.162	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	setup7.0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	8RuktpEZ8Q.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	creditcard.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	Rampage.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	RUN.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	App_installer32_64x.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	setup_run.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	Documenti di spedizione 000293949040405959000.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	104.26.12.205
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	104.21.70.128
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	Aura.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	injector V2.5.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
TELEPORT-TV-ASRU	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	109.107.181.162
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	setup7.0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	8RuktpEZ8Q.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	creditcard.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	Rampage.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	RUN.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	App_installer32_64x.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	setup_run.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse	104.26.13.205
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.13.205
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	exe010.exe	Get hash	malicious	Upatre	Browse	104.26.13.205
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	104.26.13.205
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	104.26.13.205
	order requirements CIF-TRC809945210.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	qaHUaPUib8.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.84674468132717
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrUDOwUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFlr1Ilr80yn:P+pTpcUqnsTDAFSkIrxMVlmJHaVv1UZy
MD5:	0C5350B252EEAAC53344AD1EA0C3CB21
SHA1:	B7AF4076D8916706D8370FBA3902D14610ABABB7
SHA-256:	B49600A2FAE3809A53FE0D2313053405295B7AC71ED45885FB8AB6D47BBA991B
SHA-512:	D404762DFAB7008F43B0B4DD0430C8C866B29CE5C867489EFB94C48165B4F189B1C048154DC1895158200976FC0F8FAABB25C035C701F4334F6D5BC3997E2663
Malicious:	false
Reputation:	low
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=138ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 138ms, Maximum = 138ms, Average = 138ms..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.248257080425636
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	unturnedHack.exe
File size:	4'269'056 bytes
MD5:	c5293ff604e4231fdffaa092fd7c5ca8
SHA1:	9e8aeb9ec19b8a6d534360883188872a257bb337
SHA256:	4531a1efd815df17d3a6f247d0850ab5e510de2345723e41c062716e65df686e
SHA512:	57a64316ac3944a4050853f491b85b373fc9e5f393c868d20243fcf1dfda4e733a61cf0348b7e0be25e7b880e49373131c500b5f91e7eb0c345957e070ad5fc9
SSDEEP:	49152:Xl4UjB0jUudKphZByreh+Woao/OZa8XLh+4vBTVlz8svA:14UjKgu8A
TLSH:	3D16F167ED4078FED874903488970777A67BB481833187DB2698262A5E5BBD42F3BF40
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...r_@g.........."...........9................@..............................A...........`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14004fdd0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67405F72 [Fri Nov 22 10:39:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ce5eab935d79deb808c783e73ea12cf9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F22C1105ED0h
dec eax
add esp, 28h
jmp 00007F22C1105D3Fh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [003B7248h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F22C1105F36h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [003AC582h]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [003AC4D4h]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [003AC4C0h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [003AC630h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fbdb8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x419000	0x1a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x40b000	0x6594	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41a000	0x1e18	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3efd80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe60a0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3fc1e0	0x3d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x79116	0x79200	101fd131b38e4fd5c4b31887d7ad38f3	False	0.49460421504127966	data	6.44155671990377	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7b000	0x38bebc	0x38c000	ea1096213303d3205e13cc8c1bfb1582	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x407000	0x36f8	0x1c00	7568d2f08f4ac81dae4d5e33ab60923a	False	0.17047991071428573	zlib compressed data	3.5531018656709605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x40b000	0x6594	0x6600	496dfa0147e7c873a9f17489df23c1fc	False	0.4821155024509804	data	5.74343672787325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x412000	0x38	0x200	7c2bb310d1981b513910f4cc9c8721d1	False	0.0703125	data	0.4879996533427816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x413000	0x2200	0x2200	a3fb3e1da377202334d413fbe0e439a4	False	0.4314108455882353	data	5.230691552229934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x416000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
.tls	0x417000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x418000	0x1f4	0x200	d5aa635e227a5741f7ba58c4dba5b19f	False	0.525390625	data	4.216026285396426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x419000	0x1a8	0x200	d38b4cd68eb239a7aa6a06b6f8091e1d	False	0.484375	data	4.179663701400347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x41a000	0x1e18	0x2000	6ea7154105c61bbadcf24404b7fcf3ec	False	0.6947021484375	data	6.375630824063806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x419060	0x143	XML 1.0 document, ASCII text	English	United States	0.628482972136223

Imports

DLL	Import
USER32.dll	GetRawInputDeviceInfoW, GetRawInputDeviceList
KERNEL32.dll	AcquireSRWLockExclusive, AreFileApisANSI, CloseHandle, CreateFileMappingW, CreateFileW, CreateProcessA, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FormatMessageA, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoEx, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetUserDefaultLCID, GlobalAlloc, GlobalFree, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, K32EnumDeviceDrivers, K32GetDeviceDriverBaseNameW, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MapViewOfFile, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReadProcessMemory, ReleaseSRWLockExclusive, ResumeThread, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetThreadContext, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, UnmapViewOfFile, VirtualAlloc, VirtualAllocEx, VirtualFree, VirtualProtect, VirtualQuery, VirtualQueryEx, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteProcessMemory
MPR.dll	WNetCloseEnum, WNetEnumResourceA, WNetOpenEnumA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T14:57:04.545569+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	109.107.181.162	15666	TCP
2024-11-23T14:57:04.545569+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	109.107.181.162	15666	TCP
2024-11-23T14:57:04.545569+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	109.107.181.162	15666	TCP
2024-11-23T14:57:04.668026+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	109.107.181.162	15666	TCP
2024-11-23T14:57:04.668026+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	109.107.181.162	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:56:59.374877930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:56:59.494555950 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:56:59.494712114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:56:59.715954065 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:56:59.716052055 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:56:59.716133118 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:56:59.727618933 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:56:59.727648973 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:00.945874929 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:00.946037054 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.071429014 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.071465969 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:01.071815014 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:01.071871996 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.073180914 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.119322062 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:01.397633076 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:01.397710085 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:01.397710085 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.397752047 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.398106098 CET	49731	443	192.168.2.4	104.26.13.205
Nov 23, 2024 14:57:01.398128033 CET	443	49731	104.26.13.205	192.168.2.4
Nov 23, 2024 14:57:04.545568943 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.667850971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.667900085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.667929888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668025970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.668152094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668169022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668216944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.668255091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.668268919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668311119 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668334961 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.668349028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668363094 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.668382883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668411970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.668411970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.668468952 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.787570953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.787688971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.787755966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.787774086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.787801027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.787825108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.787857056 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.787863970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.787894011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.787925959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.787957907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.787986040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.788079977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.788177967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.788191080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.788209915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.788275957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.788280964 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.788343906 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.791780949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.791855097 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.860893011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.861001015 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.907502890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.907674074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.907752037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.907812119 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.907879114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.907903910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.907979965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908129930 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908186913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908302069 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908317089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908391953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908421993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908458948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908480883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908539057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908597946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908646107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908668041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908706903 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908710003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908746004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908771038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908777952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908797026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908824921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908827066 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908852100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908881903 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908910036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.908972979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.908991098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.909044027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.909096003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.909145117 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.909152031 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.909192085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.911382914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.911421061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.911437988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.911473036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.911514044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.911566973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.981908083 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.982016087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.982074022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.982110023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:04.982136011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:04.982184887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027000904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027029037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027358055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027417898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027496099 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027542114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027573109 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027610064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027615070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027652979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027677059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027734041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027770996 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027803898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027841091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027841091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027880907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.027901888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027951956 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.027977943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028023005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028042078 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028320074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028338909 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028357983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028377056 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028408051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028410912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028426886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028453112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028480053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028492928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028513908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028547049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028573036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028594971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028613091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028687954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028723955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028743982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028786898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028809071 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028824091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028862953 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028881073 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028889894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.028923988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028992891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.028992891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029032946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029103994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029138088 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029155970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029191017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029221058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029238939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029251099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029300928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029309034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029346943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029414892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029463053 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029567003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029583931 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029603958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029654026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029681921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029701948 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029766083 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029766083 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029819965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029886961 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.029918909 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.029987097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.030029058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.030049086 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.030095100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.030925989 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.030945063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.031014919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.031035900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.031064987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.031115055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.031128883 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.031172037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.101389885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.101506948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.101555109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.101572037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.101604939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.101639032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.101703882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.146714926 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.146778107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.146806955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.146891117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.146904945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.146949053 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147032022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.147198915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147253990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.147444963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147488117 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147547960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.147577047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147614956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147692919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.147746086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147895098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147913933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147933960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.147937059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.147978067 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.147979021 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148077011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148108006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148134947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148166895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148266077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148315907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148338079 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148401022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148437023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148490906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148507118 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148547888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148637056 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148680925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148756981 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148890972 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148909092 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.148953915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.148988962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149051905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149087906 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149125099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149126053 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149202108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149207115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149249077 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149363041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149393082 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149413109 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149444103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149544954 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149584055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149626017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149677992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149729013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149749041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149813890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.149838924 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149915934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.149970055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.150016069 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150085926 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150144100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.150201082 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150268078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150337934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.150368929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150521040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150578976 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.150625944 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150641918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150696993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.150712967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150794029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.150846004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.151051044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151098013 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151154995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.151254892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151271105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151362896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.151393890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151416063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151472092 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.151499987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151536942 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151597023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.151637077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151674986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151732922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.151807070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151926041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.151993036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152137995 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152209044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152261972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152431965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152683020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152715921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152740002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152759075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152767897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152822971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152827024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152844906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152873039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152896881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152900934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152896881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152940989 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152945042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.152961016 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152982950 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.152990103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153011084 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153014898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153033972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153048038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153057098 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153065920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153091908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153096914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153117895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153141022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153146029 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153184891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153189898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153233051 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153238058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153279066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153287888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153326035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153359890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153379917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153405905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153439999 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153485060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153503895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153521061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.153537035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153568983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.153568983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.221468925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.221518993 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.221539021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.221721888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.267651081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.267671108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.267832994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.267868042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.267901897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.267955065 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.267997980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268033981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268047094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268075943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268163919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268179893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268285990 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268285036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268285990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268285990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268326998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268408060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268522978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268609047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268699884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268699884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268774033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268804073 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268862009 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.268868923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268910885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.268970013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.269006014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269041061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269083977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269100904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.269128084 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269193888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.269284010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269301891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269360065 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.269511938 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269531012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269587040 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.269623995 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269639969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269696951 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.269817114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269835949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.269893885 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270040035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270215988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270265102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270277023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270373106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270395041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270432949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270473957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270492077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270513058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270550013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270576954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270598888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270616055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270664930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270690918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270699978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270716906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270751953 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270752907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270772934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270798922 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.270806074 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270852089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.270967007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271006107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271061897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.271246910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271281004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271358967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.271388054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271409988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271470070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.271496058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271513939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271574020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.271600962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271620035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271673918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.271724939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271744013 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271795988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.271799088 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271925926 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.271982908 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272059917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272123098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272187948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272233963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272247076 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272308111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272370100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272455931 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272519112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272558928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272578955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272605896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272641897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272661924 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272666931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272831917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272861958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.272888899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.272927999 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273183107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273199081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273255110 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273269892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273307085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273365974 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273371935 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273390055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273447990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273489952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273509026 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273567915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273580074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273611069 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273663044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273684978 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273725986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273785114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.273834944 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273921967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.273981094 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.274048090 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.274115086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.274169922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.274255037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.274306059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.274360895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.341797113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.341825962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.341857910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.341876984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.341934919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.341934919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.387059927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387094021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387125969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387145042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387161016 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387304068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387356997 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.387403965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387465954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.387496948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.387620926 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387686014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387751102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.387811899 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387885094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.387938976 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.388084888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388107061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388174057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.388314009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388370037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388428926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.388484001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388524055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388588905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.388674021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388695955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388767004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.388807058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388829947 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.388890982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389045954 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389061928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389136076 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389151096 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389161110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389219999 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389269114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389312983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389367104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389461040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389481068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389537096 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389586926 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389683008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389719963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389750004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389787912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.389812946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389950991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.389982939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390023947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390063047 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390095949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390142918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390279055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390305996 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390332937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390372992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390398979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390491009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390513897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390578032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390672922 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390695095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.390729904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390757084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.390885115 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391031027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391083956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391107082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391154051 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391164064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391302109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391338110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391371012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391407967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391427040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391479015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391489983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391609907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391669035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391815901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391869068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391875029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.391930103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.391989946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392000914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392057896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.392138004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392149925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392195940 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.392268896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392291069 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392360926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.392402887 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392440081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392502069 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.392625093 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392637014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392688036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.392760038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392827988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392884016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.392977953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.392987967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393049002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393076897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393110991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393157959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393235922 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393269062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393323898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393363953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393435001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393500090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393505096 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393560886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393625021 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393661022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393704891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393711090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393769979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393835068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393857002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393913984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.393943071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.393965960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394018888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.394098997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394144058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394197941 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.394203901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394290924 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394345045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.394375086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394465923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394491911 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.394526958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.394566059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.461400032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.461410046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.461491108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.461499929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.461637020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.461637974 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.480175018 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.480531931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.507246017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507255077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507333040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507340908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507461071 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.507472038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507554054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507616997 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.507647991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507690907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507735968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507777929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.507899046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.507956982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.507976055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508094072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508157015 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.508203983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508244038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508253098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508308887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.508308887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.508464098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508615971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508676052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.508816004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508836031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.508893013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.508992910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509011984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509063959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.509352922 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509386063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509449959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.509500027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509507895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509562016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.509581089 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509591103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509641886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.509712934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509721994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509777069 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.509807110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509902000 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509912968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509919882 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.509953022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.509995937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510010004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510025978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510083914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510169029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510243893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510314941 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510366917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510375977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510433912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510438919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510453939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510514975 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510622025 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510629892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510674953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510695934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510705948 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510757923 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.510843039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510885954 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.510942936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511010885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511030912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511085033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511233091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511244059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511300087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511327982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511358976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511420012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511496067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511519909 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511584044 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511626959 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511637926 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511692047 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511735916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511744022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511796951 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.511801958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511866093 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.511924028 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512048006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512167931 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512224913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512243032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512263060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512298107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512325048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512437105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512459993 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512470961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512485027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512497902 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512547016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512547970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512582064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512613058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512639046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512669086 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512830973 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512845039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.512886047 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512922049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.512989044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513035059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513087034 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513175011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513190031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513247967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513262033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513371944 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513386965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513395071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513412952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513427973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513432980 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513478994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513484001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513484001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513514042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513533115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513560057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513645887 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513658047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513706923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513712883 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513729095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513766050 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513848066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513890028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.513901949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.513940096 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.514017105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.514035940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.514095068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.583986998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.584043980 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.584135056 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.584167957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.584280014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.584291935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.584291935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.584291935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.584418058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.603411913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.603573084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.628882885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.628891945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.628895998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.628899097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.628938913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.628947020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.628993988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629014015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629025936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629086018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629122972 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629131079 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629164934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629179001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629192114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629245043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629271030 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629324913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629326105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629384995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629437923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629446983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629487038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629522085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629550934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629554987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629611015 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629654884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629690886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629724026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629760981 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629767895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629829884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.629857063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.629921913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630125046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630187988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630220890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630273104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630304098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630361080 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630398035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630459070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630563974 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630630970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630713940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630772114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630795002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630820036 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630856037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630887985 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630892038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.630951881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.630961895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.631019115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.631084919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.631218910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.631246090 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.631295919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.631346941 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.631371975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.631421089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.632472992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.632522106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.632600069 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.633244991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.633372068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.633439064 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.633487940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.633604050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.633614063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.633615017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.633652925 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.633697033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.633964062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634067059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634126902 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.634157896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634228945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634289026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.634321928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634457111 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634464979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634536982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.634584904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634618998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634650946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.634677887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.634721041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.634979010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.635078907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.635112047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.635143042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.635195017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.708369970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.709772110 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.729676008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.730228901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.754755020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.754837036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.761924982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.762166023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.955560923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955621004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955738068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955739975 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.955790997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955811977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.955812931 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955862045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.955914021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955944061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.955965042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.955996990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956036091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956077099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956116915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956118107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956166029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956198931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956238031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956239939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956295967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956316948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956366062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956372976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956435919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956465006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956494093 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956546068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956608057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956662893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956672907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956721067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956741095 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956784964 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956784964 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956828117 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.956851006 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956886053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.956959009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957030058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957077026 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957140923 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957149029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957205057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957218885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957279921 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957346916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957406044 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957449913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957506895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957547903 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957612038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957648993 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957683086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957709074 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957750082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957782984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957838058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.957845926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957910061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.957998991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958018064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958036900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958053112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958093882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958136082 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958182096 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958209038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958250046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958264112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958328009 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958347082 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958378077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958430052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958472967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958528996 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958564043 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958606005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958628893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958659887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958671093 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958725929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958750963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958815098 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958837032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958875895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.958895922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.958934069 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959018946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959039927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959079027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959116936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959130049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959187984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959248066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959271908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959306002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959359884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959409952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959429026 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959444046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959487915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959553003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959568977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959628105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959629059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959675074 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959681034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959728956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959806919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959809065 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959855080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.959919930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.959958076 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960009098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960077047 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960098028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960131884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960194111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960231066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960259914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960365057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960367918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960396051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960460901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960469961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960515022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960580111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960587978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960681915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960747957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960757017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960839033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960882902 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.960916996 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960963011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.960995913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.961138010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.961153984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.961186886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.961211920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.961251020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:05.961251974 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:05.961636066 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.001672029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.001694918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.001729965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.001785040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.001826048 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.001888990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.001899004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.001982927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002011061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002038002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002046108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002104998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002110958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002168894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002499104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002572060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002652884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002712011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002751112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002811909 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.002908945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.002966881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.003006935 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.003073931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.003129959 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.003190994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.003665924 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.003729105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.003773928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.003830910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.005014896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.005076885 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.005150080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.005208969 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.005253077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.005312920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.005330086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.005395889 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.007704973 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.007793903 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.007832050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.007889032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.050971985 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.051098108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.075428963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075445890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075551033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.075575113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075603008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075630903 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.075659037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.075774908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075795889 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075834990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.075892925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.075942993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.075951099 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076004982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076129913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076147079 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076169968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076189041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076200008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076211929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076248884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076281071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076334000 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076334953 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076386929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076456070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076484919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076503992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076534986 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076535940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076576948 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076590061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076617956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076632977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076673031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076683998 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076723099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076765060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076781988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076808929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076816082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076837063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076849937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.076857090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.076906919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121078014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121099949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121119976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121177912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121222973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121248007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121263981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121295929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121366978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121382952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121392012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121416092 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121459961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121471882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121539116 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121546984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121562958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121618986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121637106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121640921 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121689081 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121721983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121737957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121759892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121777058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121809959 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121819019 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121859074 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121891022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121906996 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121927977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121937037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121961117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.121963024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.121985912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122006893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122057915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122070074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122103930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122122049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122131109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122160912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122178078 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122201920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122225046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122251987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122267008 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122293949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122298002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122339964 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122370005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122385979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122412920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122419119 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122437954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122467041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.122482061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.122531891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.123016119 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.123060942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.123070955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.123097897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.123111963 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.123135090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.123145103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.123171091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.123188972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.123209000 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124397039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124413013 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124443054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124460936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124469995 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124486923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124543905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124543905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124589920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124636889 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124654055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124701023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124730110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124747992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124774933 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124777079 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.124792099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.124815941 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.127243042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.127288103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.127309084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.127336025 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.127348900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.127392054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.127398014 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.127410889 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.127441883 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.127459049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.160298109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.160315037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.160413980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.190853119 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.191095114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.194976091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195070982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195080042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195131063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195148945 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195188046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195193052 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195246935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195286989 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195328951 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195355892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195389032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195406914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195422888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195461035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195491076 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195504904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195525885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195560932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195593119 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195614100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195641994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195674896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195707083 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195795059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195816040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195848942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195878983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195924044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.195977926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.195982933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196017981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196033955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196047068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196072102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196101904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196146011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196163893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196203947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196240902 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196353912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196369886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196389914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196405888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196425915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196425915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196444988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196444988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196461916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196484089 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.196487904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196507931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.196528912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.240582943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.240628958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.240681887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.240731955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.240734100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.240797043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.240937948 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241007090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241017103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241075039 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241084099 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241151094 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241240978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241302967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241367102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241424084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241435051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241493940 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241631985 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241693020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241698027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241750956 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241801023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241858959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241894960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.241962910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.241985083 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242022991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242077112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.242129087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242187977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.242222071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242275000 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242280960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.242343903 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.242465973 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242527962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.242573977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.242633104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.243781090 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.243840933 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.243865967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.243921041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.243997097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.244050980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.244087934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.244105101 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.244138002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.244174957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.244254112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.244308949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.246658087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.246711969 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.246759892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.246814013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.279727936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.279891968 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.289577007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.289688110 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.314456940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.314544916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.314554930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.314593077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.314645052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.314718962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.314771891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.314884901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.314941883 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.314949989 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315006018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315037966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315084934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315085888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315148115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315181017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315236092 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315283060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315340996 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315355062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315411091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315434933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315485954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315530062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315598965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.315622091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.315670013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.359987974 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360053062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360084057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360131979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360137939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360205889 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360248089 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360323906 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360347033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360404015 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360482931 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360523939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360541105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360582113 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360646963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360698938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360703945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360759020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360795021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360851049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360884905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.360944033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.360984087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361042976 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.361071110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361128092 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361131907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.361182928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.361217022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361282110 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.361326933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361347914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361390114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.361454010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.361887932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.361958027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.362010956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.362067938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.363267899 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.363351107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.363374949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.363430977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.363476038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.363543987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.363585949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.363631964 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.363646984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.363708973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.363753080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.363810062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.366125107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.366183043 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.366195917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.366234064 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.399245977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.399346113 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.409086943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.409183979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.434645891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.434743881 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.434762001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.434792042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.434809923 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.434844017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.434861898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.434910059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.434920073 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.434958935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.434981108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435035944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435132027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435178041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435188055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435237885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435256958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435306072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435331106 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435348988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435359001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435399055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435448885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435503960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435509920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435555935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435590982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435645103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.435691118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.435751915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480226040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480295897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480427980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480501890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480504990 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480618954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480669022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480690956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480763912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480786085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480844975 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480851889 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.480915070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.480983973 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.481024027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.481038094 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.481075048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.481097937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.481153011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.481167078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.481229067 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.482310057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.482363939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.482386112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.482419014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.482436895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.482467890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.483732939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.483787060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.483812094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.483839035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.483865976 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.483908892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.483916998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.483953953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.483972073 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.484002113 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.484204054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.484260082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.486692905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.486752033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.486752033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.486804008 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.504617929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.504736900 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.524086952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.524178982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558293104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558414936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558429003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558459997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558527946 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558562994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558598042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558613062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558625937 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558679104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558716059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558773994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558840036 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558896065 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.558939934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.558998108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.559005976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559073925 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.559286118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559349060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.559357882 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559374094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559411049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559415102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.559473038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.559500933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559562922 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.559562922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.559624910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.602691889 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.602813959 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.602839947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.602865934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.602886915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.602965117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.602987051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603040934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603080034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603142023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603158951 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603200912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603234053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603271961 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603341103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603399038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603420019 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603485107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603522062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603585958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603604078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603662968 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603672981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603722095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603729010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603774071 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603868008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603907108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.603940010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603981972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.603986979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.604053974 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.604093075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.604156017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.604651928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.604710102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.604832888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.604906082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.606076956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.606136084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.606355906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.606375933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.606405973 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.606431007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.606483936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.606580019 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.606627941 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.606638908 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.606695890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.608829975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.608892918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.609002113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.609061003 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.643990993 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.644083023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.644087076 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.644165993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.677930117 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678062916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678078890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678143024 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678222895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678268909 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678303003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678361893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678416014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678469896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678572893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678623915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678653955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678702116 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.678796053 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.678844929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.679018021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.679080009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.679195881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722162008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722292900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722306013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722337961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722404003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722418070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722465992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722484112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722557068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722559929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722620010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722656965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722714901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722765923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722826004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.722909927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722930908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.722965002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723011017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723057032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723114967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723148108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723202944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723251104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723308086 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723340988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723377943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723412037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723449945 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723474979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723534107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723550081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723615885 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723650932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723706007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.723946095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.723997116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.724004984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.724062920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.725469112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725531101 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.725596905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725641012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725653887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.725692987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.725754023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725815058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.725832939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725892067 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.725924969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725975990 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.725981951 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.726037979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.728307962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.728374004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.728385925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.728449106 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.743582010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.743649960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.763187885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.763273001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797348976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797482967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797518969 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797559977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797601938 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797601938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797640085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797669888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797745943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797807932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797823906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797851086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797882080 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797926903 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.797930002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.797982931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.798002005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.798055887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.798085928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.798144102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.798146009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.798208952 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.798221111 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.798270941 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.798278093 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.798319101 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.838974953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.839075089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.841639996 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.841743946 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.841845036 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.841943026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842125893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842163086 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842227936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842262030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842308998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842313051 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842365980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842391014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842432976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842452049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842468023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842489958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842529058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842603922 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842658997 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.842698097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.842751980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.843367100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.843425035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.844820023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.844881058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.844907999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.844966888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.844983101 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.845037937 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.845091105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.845108986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.845164061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.845354080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.845405102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.845411062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.845472097 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.851499081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.851567984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.864502907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.864605904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.884875059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.884983063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.919528961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919610977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.919657946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919688940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919703960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919722080 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.919773102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.919792891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919810057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919856071 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.919949055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.919967890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920020103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.920099974 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920149088 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.920269966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920290947 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920330048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.920363903 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.920423985 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920445919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920483112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.920572996 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.920634985 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.961792946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.961877108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.961875916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.961961031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.961968899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962009907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962058067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962107897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962246895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962296963 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962380886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962435007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962450981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962497950 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962537050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962589979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962610960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962656021 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962685108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962733030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962790012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962840080 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962858915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962908030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.962932110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.962979078 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.963033915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.963080883 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.964828968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.964930058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.982078075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.982198000 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:06.984214067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:06.984278917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.007091999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.007159948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.039011002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.039134026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.039186001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.039206982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.039283037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.039654016 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.039761066 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.039777994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.039848089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.076018095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.076081991 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081382990 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081442118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081454992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081516027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081567049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081614017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081635952 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081676960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081794024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081861973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081898928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081939936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.081953049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.081990004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082042933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082099915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082148075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082206011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082355022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082412004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082556963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082614899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082645893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082700968 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082787037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082844019 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.082845926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.082902908 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.083000898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.083060980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.083091021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.083146095 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.083175898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.083230972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.083242893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.083301067 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.083306074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.083369970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.083416939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.083482027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.084266901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.084327936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.095663071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.095765114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.095809937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.095901966 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.095944881 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.095999002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.096024990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.096088886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.096096992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.096190929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.096204042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.096235991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.096276045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.096323013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.103462934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.103545904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.123527050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.123626947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.126761913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.126817942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.158483028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.158523083 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.158596992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.158641100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.158701897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.158783913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.158819914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.158885002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.158921957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.158991098 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159235001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159252882 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159307003 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159430027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159490108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159518957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159586906 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159682035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159739017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159751892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159781933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159812927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159852982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.159892082 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.159946918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.195869923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.195957899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.200944901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201033115 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201035976 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201118946 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201154947 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201240063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201261997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201356888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201392889 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201420069 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201474905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201514959 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201548100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201591015 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201644897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201703072 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201735020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201792955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.201926947 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.201987982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202016115 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202105045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202105999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202172041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202205896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202265024 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202291965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202346087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202392101 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202450037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202485085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202543020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202660084 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202716112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202753067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202821016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202856064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202889919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202915907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202919006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.202940941 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202970982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.202975988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.203031063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.204090118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.204159021 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.215078115 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.215173006 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.215190887 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.215282917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.215307951 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.215385914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.215432882 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.215449095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.215490103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.215527058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.222910881 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.222973108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.242954969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.243055105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.246206045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.246293068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.283097029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.283209085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.296761990 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.296911001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.318129063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.318372011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.320736885 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.320838928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321017981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321048975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321119070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321178913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321180105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321253061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321300983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321358919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321394920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321460962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321506023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321566105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321615934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321674109 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321760893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321819067 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321918011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.321979046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.321985960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.322042942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.322187901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.322248936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.322271109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.322335958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.322711945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.322788954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.322804928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.322865009 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.322920084 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.322983980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.323570967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.323638916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.334779024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.334863901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.334969997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.334985971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.335072041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.335123062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.335211039 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.335220098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.335282087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.335299015 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.335350990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.335400105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.335453987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.335460901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.335519075 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.342406034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.342468023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.362592936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.362703085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.371653080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.371742964 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.402601957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.402638912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.402672052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.402723074 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.402950048 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403011084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403136969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403189898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403343916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403398037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403481007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403501987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403536081 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403552055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403563023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403608084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403667927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.403716087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.403980017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.404033899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.404145002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.404205084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.404340982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.404361963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.404396057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.404422045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.404422998 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.404473066 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.416537046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.416630983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.416649103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.416729927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.437766075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.437868118 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440128088 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440196991 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440246105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440330982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440366983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440422058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440501928 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440521955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440555096 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440593958 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440612078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440668106 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440675020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440733910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440877914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.440937996 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.440995932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441045046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441057920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441061020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441102028 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441128016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441134930 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441193104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441240072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441301107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441314936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441371918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441407919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441462994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441508055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441576004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441621065 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441637039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441693068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441881895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.441937923 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.441943884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.442003965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.443033934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.443093061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454148054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454268932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454281092 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454353094 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454359055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454380035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454421043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454529047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454549074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454576969 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454607964 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454628944 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454670906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454678059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454713106 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.454746008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.454787016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.461872101 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.461947918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.481918097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.481997967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.482049942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522156000 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522231102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522239923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522300959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522330046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522347927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522376060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522397995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522481918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522533894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522572041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522614002 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522636890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522677898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522705078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522746086 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522816896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522860050 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.522941113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.522989035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.523070097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.523114920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.523201942 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.523221016 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.523245096 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.523288012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.525966883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.526021004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.536462069 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.536533117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.559010983 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.559081078 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.561134100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.561194897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.561217070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.561269999 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.561373949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.561429024 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.561599970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.561652899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.561908960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.561992884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562042952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562104940 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562149048 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562203884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562271118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562340975 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562412977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562474966 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562525034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562576056 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562697887 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562714100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562746048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562788010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562815905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562881947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.562931061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.562983036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.563039064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.563088894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.563261032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.563369989 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.564004898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.564071894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575035095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575100899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575172901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575222015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575239897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575453043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575495958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575551987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575567961 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575609922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575674057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575723886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575752020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575810909 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575844049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575892925 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.575932980 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.575985909 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.605272055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.605384111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.605453968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.605518103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.643501997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.643630028 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.643728018 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.643790960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.643826962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.643893957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.643973112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644001007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644030094 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644057035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644088030 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644139051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644155025 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644196987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644248962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644304037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644392014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644455910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644506931 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644539118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644562960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644591093 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644644022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644695997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644711018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644747019 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.644804001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.644855022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.655699015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.655801058 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.680582047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.680679083 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.682524920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.682585955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.682652950 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.682715893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.682854891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.682882071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.682912111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.682943106 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.682986021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683039904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.683135986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683198929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.683459997 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683487892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683514118 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.683542967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.683796883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683825016 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683882952 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.683954954 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.683981895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.684003115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.684032917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.684089899 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.684117079 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.684139967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.684169054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.684576035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.684604883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.684628010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.684655905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.685430050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.685497046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.694327116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.694397926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.694459915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.694514990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.694667101 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.694701910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.694724083 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.694761038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.694813967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.694866896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.695051908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.695108891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.695288897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.695360899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.725289106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.725377083 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.725449085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.725508928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763068914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763170004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763359070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763390064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763415098 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763444901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763478994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763515949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763545990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763581038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763617992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763679028 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763751984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763804913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763864994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.763914108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.763998985 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764051914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764067888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764101982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764223099 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764280081 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764341116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764400005 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764465094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764517069 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764578104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764627934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764775991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764837027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764889002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.764935970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.764991999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.765053988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.775141954 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.775219917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.775298119 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.775357008 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.800180912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.800277948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.801821947 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.801899910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802058935 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802119970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802225113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802285910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802330971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802396059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802442074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802493095 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802606106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802639961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802665949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802695036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802850962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.802910089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.802972078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803025961 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803083897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803143978 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803210974 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803258896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803361893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803421021 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803467035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803514004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803662062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803719044 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803798914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.803881884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.803931952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804039001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.804234028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804297924 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.804339886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804399967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.804460049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804512978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804528952 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.804565907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.804603100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804655075 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.804723024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.804776907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.813713074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.813766003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.813796043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.813827038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.813884974 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.813939095 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.814033031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.814086914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.814173937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.814227104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.814398050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.814450026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.814496040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.814543962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.814657927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.814685106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.814707041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.814738035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.845535040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.845613003 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.845679045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.845746994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.882595062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.882672071 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.882723093 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.882775068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883048058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883105040 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883148909 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883203983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883286953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883347988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883385897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883476019 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883510113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883543968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883564949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883589029 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883644104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883676052 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883697033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883723974 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883776903 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883810043 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883831024 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883860111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.883922100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.883980989 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.884023905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.884083033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.884114027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.884169102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.884203911 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.884249926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.884279966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.884330034 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.895776987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.895836115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.919941902 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.920085907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.921775103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.921829939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922024012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922094107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922190905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922250986 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922290087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922346115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922425032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922508955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922557116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922610044 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922657013 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922708988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922724962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922760010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.922924995 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.922976017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923110962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923139095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923166037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923192978 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923362017 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923417091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923547029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923605919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923660040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923715115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923741102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923772097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923791885 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923819065 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923871040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923902988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.923923016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.923970938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.924025059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.924074888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.924225092 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.924276114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.924371004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.924423933 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.924912930 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.924947023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.924972057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.924997091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.934484005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.934541941 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.934560061 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.934617996 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.934633970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.934669018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.934959888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.935000896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.935049057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.935064077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.935086966 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.935101032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.935358047 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.935401917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.935430050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.935472965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.935620070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.935667038 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.967526913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.967621088 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:07.967679977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:07.967735052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.086862087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.086905003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.086941004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.086994886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087034941 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087064028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087089062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087119102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087151051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087182045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087207079 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087244987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087260962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087299109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087366104 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087435007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087462902 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087486029 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087511063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087541103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087568045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087591887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087615967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087644100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087671995 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087693930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087718964 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087749958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087779999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087819099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087867975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087896109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.087918997 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.087944984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088041067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088068962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088092089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088119984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088151932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088186979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088212013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088238955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088311911 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088339090 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088368893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088396072 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088424921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088453054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088474035 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088500977 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088530064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088557005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088581085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088606119 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088637114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088665962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088686943 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088716030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088743925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088771105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088805914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088843107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088876009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088905096 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088926077 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.088964939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.088984966 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089014053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089045048 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089072943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089102983 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089133978 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089168072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089195967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089216948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089245081 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089292049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089318991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089345932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089368105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089467049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089495897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089519978 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089550018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089584112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089612007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089647055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089673996 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089699030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089729071 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089756012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089778900 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089803934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089833021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089862108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089881897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089911938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.089941978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089968920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.089991093 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.090023041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.206594944 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206645012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206691980 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206724882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.206765890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.206799984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206828117 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206852913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.206883907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.206913948 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206942081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.206965923 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.206990004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207020044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207047939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207073927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207099915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207127094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207179070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207233906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207262039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207284927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207310915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207391977 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207420111 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207448959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207474947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207515955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207544088 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207566023 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207588911 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207618952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207648039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207668066 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207694054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.207724094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.207912922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.208992004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209026098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209055901 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209081888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209109068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209136963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209165096 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209177971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209208012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209232092 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209258080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209285975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209315062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209343910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209369898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209397078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209425926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209450960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209481001 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209508896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209532022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209562063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209589005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209619999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209641933 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209667921 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209700108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209728003 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209750891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209774971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209805012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209831953 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209861040 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209887028 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209917068 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209944010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.209968090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.209992886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210025072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210053921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210074902 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210100889 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210131884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210159063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210181952 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210208893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210238934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210300922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210335970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210369110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210391998 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210417032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210448027 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210477114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210496902 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210525990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210556984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210587978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.210609913 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.210640907 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.243134022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.243268013 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280029058 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280077934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280107975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280145884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280198097 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280234098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280262947 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280292988 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280319929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280347109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280375957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280416012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280440092 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280462980 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280520916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280550957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280577898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280693054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280839920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280889988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280905962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280940056 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.280961037 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.280988932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.281009912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.281044006 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.281516075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.281593084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.281682968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.281711102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.281733990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.281768084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.281824112 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.281871080 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282182932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282246113 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282293081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282355070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282422066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282476902 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282516956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282568932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282610893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282644033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282666922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282695055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282752991 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282804966 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.282897949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.282958031 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283178091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283232927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283303022 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283351898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283385992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283437967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283540964 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283567905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283595085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283618927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283672094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283700943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283723116 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283751965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.283879042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.283930063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.284507036 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.284565926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.284626007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.284686089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.293833971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.293920994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.293972015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294003963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294025898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294050932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294106007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294167042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294213057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294262886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294608116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294671059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294739008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294770956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294796944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294819117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.294883966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.294934034 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.326395035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.326544046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.327510118 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.327594042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.362454891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.362588882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.362643957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.362719059 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.362756014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.362811089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.362919092 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.362992048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363035917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363090992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363192081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363253117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363384962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363440990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363486052 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363529921 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363596916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363650084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363698006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363749027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363817930 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.363873959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.363949060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364006042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.364084005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364134073 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.364219904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364274979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.364343882 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364398956 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.364440918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364491940 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.364561081 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364626884 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.364669085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.364717007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.375118971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.375200033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.399525881 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.399647951 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.399749994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.399822950 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401113987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401156902 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401194096 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401238918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401273966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401310921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401343107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401376009 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401525021 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401575089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401699066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401731968 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401751995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401776075 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401810884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401864052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401890039 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.401936054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.401976109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402026892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402097940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402132034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402160883 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402189970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402245998 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402297020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402636051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402687073 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402761936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402793884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402818918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402842045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402885914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.402935982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.402962923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.403012037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.403069973 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.403125048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.403146982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.403192043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.403251886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.403301001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.403917074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.403970957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.403997898 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.404053926 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.413197041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.413261890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.413295984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.413357019 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.413386106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.413429022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.413599014 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.413646936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.414062023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.414110899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.414254904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.414315939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.414366961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.414418936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.445923090 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.446007967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.446048021 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.446091890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.447010994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.447089911 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482001066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482161045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482333899 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482363939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482412100 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482435942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482469082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482595921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482625961 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482659101 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482686043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482745886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482774019 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482799053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482831955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482862949 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482897043 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.482920885 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482945919 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.482976913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483022928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.483052015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483084917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483107090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.483144999 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.483194113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483226061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483247042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.483285904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.483361006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483390093 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.483429909 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.494484901 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.494565010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.519058943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.519153118 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.519211054 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.519268990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.520423889 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.520452023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.520493031 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.520539045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.520719051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.520777941 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.520999908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521045923 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521075964 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521126032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521162987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521209955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521375895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521428108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521476984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521508932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521531105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521565914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521611929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521646023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521687031 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521713972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.521779060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.521827936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522134066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522192001 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522289038 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522321939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522344112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522373915 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522404909 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522440910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522466898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522504091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522525072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522591114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522618055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522666931 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.522691965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.522735119 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.523339987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.523389101 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.523422956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.523453951 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.523475885 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.523504019 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.533077002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.533157110 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.533190966 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.533246994 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.533293009 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.533343077 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.533776999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.533829927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.533874035 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.533921957 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.533981085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.534030914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.565560102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.565604925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.565699100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.566481113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.566560030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.601353884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601459026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.601663113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601692915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601730108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601753950 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.601784945 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.601824999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601852894 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601891041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.601918936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.601942062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601970911 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.601993084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602026939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602066040 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602099895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602135897 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602164984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602258921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602292061 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602313995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602340937 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602529049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602587938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602650881 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602683067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602704048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602730036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602785110 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602838993 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.602861881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.602894068 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.614130020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.614232063 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.639034986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.639121056 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.639179945 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.639235973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.640415907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.640476942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.640552044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.640604973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.640678883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.640732050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.640753031 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.640779972 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.640816927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.640863895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.640983105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641036034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641051054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641086102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641200066 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641253948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641336918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641365051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641390085 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641418934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641458988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641490936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641519070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641547918 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641657114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641689062 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.641710997 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641736031 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.641957045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642004967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642036915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642098904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642251015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642298937 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642347097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642400026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642474890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642505884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642534971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642560005 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642616987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642666101 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642712116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642757893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.642898083 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.642951965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.643019915 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.643070936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.652409077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.652435064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.652504921 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.652565002 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.652580023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.652610064 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.652626991 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.652657032 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.652697086 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.653331041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.653381109 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.653407097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.653455973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.653487921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.653534889 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.686762094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.686878920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.687792063 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.687865973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.720952988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721045971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721107960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721172094 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721187115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721232891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721298933 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721365929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721396923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721443892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721492052 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721554995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721848965 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721882105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.721904993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.721940041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722039938 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722088099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722109079 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722162962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722297907 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722353935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722441912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722495079 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722563028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722610950 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722645044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722693920 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722759962 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722790956 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722819090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722850084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.722904921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.722950935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.733489990 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.733573914 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.760191917 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.760243893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.760317087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.760387897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.760416985 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.760440111 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.760471106 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.760545969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.760575056 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.760603905 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.760631084 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761050940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761082888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761106014 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761138916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761223078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761329889 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761393070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761420012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761445999 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761475086 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761512041 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761538982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761560917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761590004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761624098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761652946 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761673927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761701107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761739969 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761768103 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761790037 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761811018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761848927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.761899948 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.761962891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.762012959 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.762058020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.762116909 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.762150049 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.762258053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.762414932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.762465000 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.762518883 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.762567043 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.771812916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.771877050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.771893024 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.771923065 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.771956921 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.772010088 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.772058964 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.772100925 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.772599936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.772650003 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.772710085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.772742033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.772764921 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.772789955 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.772826910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.772874117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.806299925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.806345940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.806380987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.806422949 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.807236910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.807305098 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.807420015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.807482004 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.840528011 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.840619087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.840686083 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.840780020 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.840845108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.840878010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.840899944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.840925932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841119051 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841175079 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841223955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841279030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841327906 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841361046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841391087 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841419935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841456890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841510057 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841562033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841594934 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841629982 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841655016 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841742992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841809988 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841825962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841862917 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.841912031 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841943979 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.841964960 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.842006922 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.842063904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.842122078 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.853261948 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.853349924 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.878771067 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.878806114 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.878851891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.878890991 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.878948927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.878981113 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.879010916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.879051924 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.880521059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.880554914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.880575895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.880619049 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.880692005 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.880748034 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.880764008 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.880804062 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.880851984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.880882978 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.880908012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.880944967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881419897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881448030 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881480932 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881517887 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881557941 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881587029 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881635904 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881702900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881731033 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881759882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881786108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881810904 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881869078 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881885052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881922960 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.881937981 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.881977081 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882070065 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882102013 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882122993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882149935 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882184982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882246971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882280111 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882309914 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882329941 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882391930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882425070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882477045 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882675886 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882741928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.882843018 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.882903099 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.891246080 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.891292095 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.891422033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.892379999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.892477036 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.925928116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.926014900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.926059961 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.926104069 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.926127911 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.926191092 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.926755905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.926815987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.960285902 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.960344076 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.960391045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.960419893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.960465908 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.960508108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.960537910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.960576057 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.960593939 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.960630894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.960676908 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.960980892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961062908 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961123943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961180925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961208105 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961236000 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961265087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961298943 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961328030 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961354971 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961401939 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961464882 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961505890 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961536884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961560011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961606979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961782932 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.961838007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.961963892 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.962023973 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.974227905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.974298000 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.989682913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.989871979 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.999074936 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.999166965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:08.999214888 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:08.999289989 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.000719070 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.000793934 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.000860929 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.000893116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.000941992 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001010895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001039982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001075029 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001105070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001152992 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001180887 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001209974 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001236916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001447916 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001481056 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001530886 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001595020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001658916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001759052 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001785994 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001818895 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001851082 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001878023 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001908064 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.001934052 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001962900 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.001995087 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002022982 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002051115 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002079010 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002108097 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002140999 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002166986 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002199888 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002228975 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002260923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002288103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002312899 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002424955 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002456903 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002481937 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002509117 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002652884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002686024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.002712011 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.002734900 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.010739088 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.010773897 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.010803938 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.010838032 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.010893106 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.010924101 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.010948896 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.010984898 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.011384010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.011418104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.011441946 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.011471987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.011528015 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.011583090 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.011609077 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.011667967 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.048049927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.048113108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.048171043 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.048239946 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.048824072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.048887968 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.080250025 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080291986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080348969 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.080492020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080522060 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080548048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.080588102 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.080617905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080652952 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080697060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.080763102 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080816984 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.080878019 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.080929995 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081049919 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081101894 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081127882 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081177950 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081229925 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081260920 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081289053 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081315041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081367970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081399918 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081428051 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081474066 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081631899 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081687927 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.081754923 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.081809998 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.093722105 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.094547033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.109395981 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.109469891 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.118592024 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.118657112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.118721008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.118778944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120250940 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.120325089 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120368004 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.120404959 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.120429993 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120455027 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120511055 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.120543957 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.120567083 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120608091 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120800972 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.120873928 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.120966911 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121023893 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121047020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121108055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121198893 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121226072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121267080 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121300936 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121330976 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121390104 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121403933 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121434927 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121457100 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121498108 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121531010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121562958 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121584892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121646881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121684074 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121740103 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121769905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121803045 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121824980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121849060 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121906042 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121933937 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.121958017 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.121985912 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.122033119 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.122086048 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.122117996 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.122169018 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.122229099 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.122288942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.130340099 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.130409956 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.130474091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.130501986 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.130532980 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.130561113 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.130592108 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.130639076 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.131011963 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.131061077 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.131092072 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.131124020 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.131145954 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.131186962 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.168087006 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.168123007 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.168162107 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.168200970 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.168886900 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.168941975 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.199671984 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.199742079 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.199822903 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.199887991 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.199956894 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200017929 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200133085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200165987 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200189114 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200216055 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200350046 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200417042 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200644970 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200711012 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200774908 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200831890 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200867891 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.200925112 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.200989008 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201036930 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201102018 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201154947 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201308012 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201368093 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201608896 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201642036 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201662064 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201694965 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201747894 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201776028 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201798916 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201828003 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201863050 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201915026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.201941967 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.201993942 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.213267088 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.213329077 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.238910913 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.239013910 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.239077091 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.239155054 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.240816116 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.240879059 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.240895033 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.240936041 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.240995884 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241048098 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.241074085 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241122007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.241166115 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241219044 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241234064 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.241276026 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.241319895 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241389990 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.241429090 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241486073 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.241823912 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.241908073 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242002010 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242029905 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242063046 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242089987 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242135048 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242183924 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242218971 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242269039 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242295980 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242346048 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242362022 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242397070 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242453098 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242503881 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.242566109 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.242649078 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.250863075 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.250936985 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.251027107 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.251056910 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.251081944 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.251113892 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.251147985 CET	15666	49730	109.107.181.162	192.168.2.4
Nov 23, 2024 14:57:09.251199007 CET	49730	15666	192.168.2.4	109.107.181.162
Nov 23, 2024 14:57:09.251599073 CET	15666	49730	109.107.181.162	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 14:56:59.567337036 CET	192.168.2.4	1.1.1.1	0x9043	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 14:56:59.705869913 CET	1.1.1.1	192.168.2.4	0x9043	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:56:59.705869913 CET	1.1.1.1	192.168.2.4	0x9043	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:56:59.705869913 CET	1.1.1.1	192.168.2.4	0x9043	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.13.205	443	6668	C:\Users\user\Desktop\unturnedHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:57:01 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-11-23 13:57:01 UTC	399	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:57:01 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e71aa7abc121875-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1687&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=1760096&cwnd=153&unsent_bytes=0&cid=0a57f3c0a02e4852&ts=463&x=0"
2024-11-23 13:57:01 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Target ID:	0
Start time:	08:56:57
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\unturnedHack.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\unturnedHack.exe"
Imagebase:	0x7ff6c09c0000
File size:	4'269'056 bytes
MD5 hash:	C5293FF604E4231FDFFAA092FD7C5CA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:56:58
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\unturnedHack.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\unturnedHack.exe"
Imagebase:	0x7ff6c09c0000
File size:	4'269'056 bytes
MD5 hash:	C5293FF604E4231FDFFAA092FD7C5CA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000001.00000002.1943610876.000002A22DC87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:57:24
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\unturnedHack.exe"
Imagebase:	0x7ff6ada10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:57:24
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:57:25
Start date:	23/11/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff7ed070000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FF6C0A0FDE4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6C0A0FE10
GetCurrentThreadId.KERNEL32 ref: 00007FF6C0A0FE1E
GetCurrentProcessId.KERNEL32 ref: 00007FF6C0A0FE2A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6C0A0FE3A

Memory Dump Source

Source File: 00000000.00000002.1674730161.00007FF6C09C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C09C0000, based on PE: true

Associated: 00000000.00000002.1674716105.00007FF6C09C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674767160.00007FF6C0A3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674767160.00007FF6C0A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674767160.00007FF6C0DAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674981596.00007FF6C0DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674995930.00007FF6C0DCB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674995930.00007FF6C0DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675024012.00007FF6C0DD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c09c0000_unturnedHack.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 66dffe7ee173be83caf6d25513cd58fc43f63803bf13eaf2a3b2507e135e52d1
Instruction ID: 4b8f8af99a0a36e3e57aea45d3c1741a607fdf6e0a13b17ca14abc6b298be07a
Opcode Fuzzy Hash: 66dffe7ee173be83caf6d25513cd58fc43f63803bf13eaf2a3b2507e135e52d1
Instruction Fuzzy Hash: AA112A22B14F069AEB00DF60E8542B833A4FB59759F441E31DAADC67A4DF7CE1548380

Analysis Process: unturnedHack.exePID: 6668, Parent PID: 6592COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	2000
Total number of Limit Nodes:	82

Executed Functions

Function 00000001400831C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 227
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 0000000140083201
GetSystemMetrics.USER32 ref: 000000014008320F
GetSystemMetrics.USER32 ref: 000000014008321D
GetSystemMetrics.USER32 ref: 000000014008322B
GetDC.USER32 ref: 0000000140083235
GetDeviceCaps.GDI32 ref: 000000014008324B
GetDeviceCaps.GDI32 ref: 000000014008325B
CreateCompatibleDC.GDI32 ref: 0000000140083268
CreateCompatibleBitmap.GDI32 ref: 0000000140083280
SelectObject.GDI32 ref: 0000000140083296
BitBlt.GDI32 ref: 00000001400832CC
SHCreateMemStream.SHLWAPI ref: 0000000140083302
SelectObject.GDI32 ref: 0000000140083318
DeleteDC.GDI32 ref: 0000000140083321
ReleaseDC.USER32 ref: 000000014008332C
DeleteObject.GDI32 ref: 0000000140083335
EnterCriticalSection.KERNEL32 ref: 000000014008342C
LeaveCriticalSection.KERNEL32 ref: 000000014008343E
IStream_Size.SHLWAPI ref: 0000000140083475
IStream_Reset.SHLWAPI ref: 0000000140083486
IStream_Read.SHLWAPI ref: 0000000140083513
SelectObject.GDI32 ref: 000000014008356D
DeleteDC.GDI32 ref: 0000000140083576
ReleaseDC.USER32 ref: 0000000140083583
DeleteObject.GDI32 ref: 000000014008358C

Strings

, xrefs: 00000001400832A1

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 128abfd2b101a0e68aac01b1bdead559c1247fe31ad61a4bcdf76249211401bb
Instruction ID: c2880041f68b3ec6f9f24cabef7a69fa4d5574964d3bb23674469d59c00c7863
Opcode Fuzzy Hash: 128abfd2b101a0e68aac01b1bdead559c1247fe31ad61a4bcdf76249211401bb
Instruction Fuzzy Hash: 9AB13972208BC086E765DB22E8543DAB3A5F7CDB80F409615EB8A47B69DF7CC194CB00

Function 00000001400C2000 Relevance: 28.9, APIs: 2, Strings: 14, Instructions: 900COMMON

Download Yara Rule

Strings

mov , xrefs: 00000001400C2830
mov [, xrefs: 00000001400C2B1B
lea rsp, [rsp - 0x80], xrefs: 00000001400C2243
AsmJit error: , xrefs: 00000001400C2E48
invalid map<K, T> key, xrefs: 00000001400C2F61
, xrefs: 00000001400C2AA1
Translation address: , xrefs: 00000001400C2E92
ret , xrefs: 00000001400C1E67, 00000001400C1ED4, 00000001400C2009
, [, xrefs: 00000001400C2858
push , xrefs: 00000001400C2295, 00000001400C2427
Translation:, xrefs: 00000001400C2D1D
AsmTK error: , xrefs: 00000001400C2DCD
pop , xrefs: 00000001400C2B94, 00000001400C2BC5
], , xrefs: 00000001400C2B2F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: $, [$AsmJit error: $AsmTK error: $Translation address: $Translation:$], $invalid map<K, T> key$lea rsp, [rsp - 0x80]$mov $mov [$pop $push $ret
API String ID: 0-682514236
Opcode ID: ffc5cbca3884fe4297044f1e9e874b1e43500943e0b59c6f8d4e4a8ade3bbdca
Instruction ID: 8e31c588432ae9dfe787f4905c5db89dd43e2edcf19ef45c030b344e87f531ee
Opcode Fuzzy Hash: ffc5cbca3884fe4297044f1e9e874b1e43500943e0b59c6f8d4e4a8ade3bbdca
Instruction Fuzzy Hash: EB928B72614BC495EB26DF66D8803ED6361F7997C8F805222EB5D0BAEADF74C685C300

Function 00000001400EB5E0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400EB68D
GetLastError.KERNEL32 ref: 00000001400EB697
FindFirstFileW.KERNEL32 ref: 00000001400EB6AE
GetLastError.KERNEL32 ref: 00000001400EB6BA
FindClose.KERNEL32 ref: 00000001400EB6C8
__std_fs_open_handle.LIBCPMT ref: 00000001400EB75B
CloseHandle.KERNEL32 ref: 00000001400EB771
CloseHandle.KERNEL32 ref: 00000001400EB8E4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 85049687b5dde28f65619eec6ecb9dcc7cc2f377e42605e75442889216d79f68
Instruction ID: ab65b6196f4d0b15e7dedcf6af6ae7a513315dbf83660c4e66348b03d4328bed
Opcode Fuzzy Hash: 85049687b5dde28f65619eec6ecb9dcc7cc2f377e42605e75442889216d79f68
Instruction Fuzzy Hash: 26918E35304A4186F66A8B27A9447EA62A4A78DBF4F180314FBB657BF4DF38CC41C780

Function 000000014003E240 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003E32C
GetProcAddress.KERNEL32 ref: 000000014003E437
GetProcAddress.KERNEL32 ref: 000000014003E4F9
GetProcAddress.KERNEL32 ref: 000000014003E573
GetProcAddress.KERNEL32 ref: 000000014003E5F5
GetProcAddress.KERNEL32 ref: 000000014003E66F
GetProcAddress.KERNEL32 ref: 000000014003E6F3
FreeLibrary.KERNEL32 ref: 000000014003F221

Strings

vault, xrefs: 000000014003F083
system, xrefs: 000000014003F02D
cannot use push_back() with , xrefs: 000000014003F26F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 7e008bb2eefdb1bed5ff8c8029004a79adc81ae7499e8d02dea0ee6463ec00e2
Instruction ID: 7b1a0efe72fd8a0a886c56457a328bd3398064304eabf81e033fc23de5a62188
Opcode Fuzzy Hash: 7e008bb2eefdb1bed5ff8c8029004a79adc81ae7499e8d02dea0ee6463ec00e2
Instruction Fuzzy Hash: C6922C32205BC489DB62CF2AE8843DE77A5F749798F104225EB9C5BBA9EF74C654C700

Function 00000001400C3180 Relevance: 19.8, Strings: 15, Instructions: 1071
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Trampoline:, xrefs: 00000001400C3F7D
ions, xrefs: 00000001400C379D
one, xrefs: 00000001400C3C30
Prologue to overwrite:, xrefs: 00000001400C3CB1
Hook instructions: , xrefs: 00000001400C4140
failed, xrefs: 00000001400C383F
Chosen detour scheme: , xrefs: 00000001400C392A
UNKNOWN, xrefs: 00000001400C38FC
Trampoline Jmp Tbl:, xrefs: 00000001400C408A
m_fnAddress: , xrefs: 00000001400C320A, 00000001400C3274
m_trampoline: , xrefs: 00000001400C3E06
Hook size: , xrefs: 00000001400C4236
Original function:, xrefs: 00000001400C34DF
m_trampolineSz: , xrefs: 00000001400C3EAA
Prologue offset: , xrefs: 00000001400C42C8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: one$Chosen detour scheme: $Hook instructions: $Hook size: $Original function:$Prologue offset: $Prologue to overwrite:$Trampoline Jmp Tbl:$Trampoline:$UNKNOWN$failed$ions$m_fnAddress: $m_trampoline: $m_trampolineSz:
API String ID: 0-2571529286
Opcode ID: d906911f282cb8be07b0eb6f2193e6166405f42d0ee956e1b34831a98077f698
Instruction ID: 722c7ad0a59a0f774c1981fa7e694dda850d2a85773e1a74770c57e408a5d77a
Opcode Fuzzy Hash: d906911f282cb8be07b0eb6f2193e6166405f42d0ee956e1b34831a98077f698
Instruction Fuzzy Hash: D5B29272614BC086EB26DF36D8413ED7361F799788F419216EB8D17AAADF78C285C340

Function 00000001400C4530 Relevance: 17.2, APIs: 1, Strings: 8, Instructions: 1457COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400C486F
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400C5EEF

Strings

Instructions needing entry:, xrefs: 00000001400C4A3C
Jmp To Prol:, xrefs: 00000001400C577E, 00000001400C5B86
Instructions needing translation:, xrefs: 00000001400C4E7B
jmp, xrefs: 00000001400C4594
m_fnAddress: , xrefs: 00000001400C489E
Trampoline address: , xrefs: 00000001400C4F8D
Original function:, xrefs: 00000001400C489C
Instructions needing relocation:, xrefs: 00000001400C4B9E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $jmp$m_fnAddress:
API String ID: 118556049-1617887432
Opcode ID: 1f19bedc96ea4007c3410813be0b74035384993e1ecd5fc41ef9157d5315984a
Instruction ID: 39f68c70dbf2ddd6a5ee37d68b621320f85aeff886ea49b8b4676c1929870a95
Opcode Fuzzy Hash: 1f19bedc96ea4007c3410813be0b74035384993e1ecd5fc41ef9157d5315984a
Instruction Fuzzy Hash: 37E26772614BC089EB26DF66D8843ED2761F799BD8F544212EB5D07BAADF78C684C300

Function 00000001400796D0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 416
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007CDE0: GetCurrentProcess.KERNEL32 ref: 000000014007CE1B
Part of subcall function 000000014007CDE0: OpenProcessToken.ADVAPI32 ref: 000000014007CE2E
Part of subcall function 000000014007CDE0: GetTokenInformation.ADVAPI32 ref: 000000014007CE6A
Part of subcall function 000000014007CDE0: CloseHandle.KERNEL32 ref: 000000014007CE8B

ExitProcess.KERNEL32 ref: 0000000140079728
OpenMutexA.KERNEL32 ref: 0000000140079843
ExitProcess.KERNEL32 ref: 0000000140079853
CreateMutexA.KERNEL32 ref: 0000000140079872

Part of subcall function 000000014007D120: GetModuleFileNameW.KERNEL32 ref: 000000014007D16A

Part of subcall function 00000001400886E0: CoInitializeEx.OLE32 ref: 000000014008874A

ExitProcess.KERNEL32 ref: 000000014007994F

Strings

SeDebugPrivilege, xrefs: 000000014007972F
SeImpersonatePrivilege, xrefs: 000000014007973B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CloseCreateCurrentFileHandleInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 4279366119-3768118664
Opcode ID: 06a700cdb99de20ca811ff3bd65a360d898f8263909852c7284b3765b97a660e
Instruction ID: 9372ac5fd93a19f3f1932ce0cc495518a589619b024757e98eecc588e9f40af0
Opcode Fuzzy Hash: 06a700cdb99de20ca811ff3bd65a360d898f8263909852c7284b3765b97a660e
Instruction Fuzzy Hash: 7A122D71228AC5A1EA26EB66E8513EE6361F7D93C0F804516F78D439FAEF78C605C740

Function 00000001400C4890 Relevance: 15.2, APIs: 1, Strings: 7, Instructions: 1164COMMON

Download Yara Rule

Strings

Instructions needing entry:, xrefs: 00000001400C4A3C
Jmp To Prol:, xrefs: 00000001400C577E, 00000001400C5B86
Instructions needing translation:, xrefs: 00000001400C4E7B
m_fnAddress: , xrefs: 00000001400C489E
Trampoline address: , xrefs: 00000001400C4F8D
Original function:, xrefs: 00000001400C489C
Instructions needing relocation:, xrefs: 00000001400C4B9E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $m_fnAddress:
API String ID: 0-38338247
Opcode ID: 68a7a54f49957c6277f71e2566eea85297d2aa494d61c501fce91bc6bd8d07c6
Instruction ID: c459fc1c69ecbeb776379cc013230e06390ed4b20aa57cad59e96dbcb2a218b6
Opcode Fuzzy Hash: 68a7a54f49957c6277f71e2566eea85297d2aa494d61c501fce91bc6bd8d07c6
Instruction Fuzzy Hash: C4C27B32614BC089EB26DF66D8843ED6761F799BD8F545212EB5D07BAADF78C284C300

Function 00000001400AA588 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400AA5CD

Part of subcall function 00000001400A9C34: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A9C48

Part of subcall function 00000001400A47C0: HeapFree.KERNEL32 ref: 00000001400A47D6
Part of subcall function 00000001400A47C0: GetLastError.KERNEL32 ref: 00000001400A47E0

Part of subcall function 00000001400B31D4: _invalid_parameter_noinfo.LIBCMT ref: 00000001400B311F

_get_daylight.LIBCMT ref: 00000001400AA5BC

Part of subcall function 00000001400A9C94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A9CA8

_get_daylight.LIBCMT ref: 00000001400AA832
_get_daylight.LIBCMT ref: 00000001400AA843
_get_daylight.LIBCMT ref: 00000001400AA854
GetTimeZoneInformation.KERNEL32 ref: 00000001400AA87B

Strings

Eastern Summer Time, xrefs: 00000001400AA939
Eastern Standard Time, xrefs: 00000001400AA921

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 09ada61799f9e34989d6b846d1425fa5122a705a702ae65f731ec7cff66c12f5
Instruction ID: 70598f562d2ddc589124af690dd7f43025cadc9b9000907b717628ea3b21ae92
Opcode Fuzzy Hash: 09ada61799f9e34989d6b846d1425fa5122a705a702ae65f731ec7cff66c12f5
Instruction Fuzzy Hash: 10D18E3670065086EB22EF27D8507EE77A1E7ADBD4F458226BB09476E5DB3CC8818B40

Function 0000000140082890 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0000000140082A5B
InternetOpenUrlA.WININET ref: 0000000140082B38
HttpQueryInfoW.WININET ref: 0000000140082B99
HttpQueryInfoW.WININET ref: 0000000140082C32
InternetQueryDataAvailable.WININET ref: 0000000140082C76
InternetReadFile.WININET ref: 0000000140082D39
InternetQueryDataAvailable.WININET ref: 0000000140082E04
InternetCloseHandle.WININET ref: 0000000140082EAE
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140082F0B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: 6dd204f8519aa3c7dacdec8efb6c46bc8c3bb9e8dd47316586070783492dafbb
Instruction ID: 14396d47e66076a05125b02f8d589086dc94027cac967fc8858d3876529e4c62
Opcode Fuzzy Hash: 6dd204f8519aa3c7dacdec8efb6c46bc8c3bb9e8dd47316586070783492dafbb
Instruction Fuzzy Hash: 81025B33A14B9486EB11CB6AE84039EB7B5F799B94F204215EF9D17BA9DF78C190C700

Function 00000001400F2268 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400F1E4C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400F1E8D
Part of subcall function 00000001400F1E4C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400F1F0B
Part of subcall function 00000001400F1E4C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400F1F5C

CreateFileW.KERNEL32 ref: 00000001400F236E
CreateFileW.KERNEL32 ref: 00000001400F23BE
GetLastError.KERNEL32 ref: 00000001400F23EE
GetFileType.KERNEL32 ref: 00000001400F2403
GetLastError.KERNEL32 ref: 00000001400F240D
CloseHandle.KERNEL32 ref: 00000001400F2440
CloseHandle.KERNEL32 ref: 00000001400F25A3
CreateFileW.KERNEL32 ref: 00000001400F25D8
GetLastError.KERNEL32 ref: 00000001400F25E7

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 88c67a62c97e9640d8f824194156037d4643487aa4b8d57f45b5f64436b2e6ec
Instruction ID: 8a3b17929fbc665bd3ad053a207659bb0b005a1d555a96477d950db478f30d7b
Opcode Fuzzy Hash: 88c67a62c97e9640d8f824194156037d4643487aa4b8d57f45b5f64436b2e6ec
Instruction Fuzzy Hash: 4AC1BF36720A4086EB55CFA6C4917EC37A1F34DBA8F01521AEF2A9B7A4CB74C456D740

Function 000000014005D2B0 Relevance: 13.6, APIs: 1, Strings: 6, Instructions: 1378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

status, xrefs: 0000000140061560, 0000000140061639, 00000001400616F0, 00000001400617C3, 00000001400617E5, 00000001400617FB, 000000014006181D, 0000000140063C17
exists, xrefs: 000000014006153E, 000000014006160C, 00000001400616CE, 000000014006179C, 0000000140063BEE, 0000000140063F77, 0000000140063F8C
cannot use push_back() with , xrefs: 0000000140061585, 000000014006165E, 0000000140061715
directory_iterator::directory_iterator, xrefs: 00000001400617B3, 00000001400617D5, 000000014006180D, 0000000140063C01
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00000001400615EF, 0000000140061629, 000000014006177F
recursive_directory_iterator::operator++, xrefs: 00000001400615D8, 00000001400616A5, 0000000140061768

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: 8994815c00e3edcedd388d433c4596355d862ec9a273bfa7c043287320621a6d
Instruction ID: 9ac92b5f99d6d6681253c887a5c11221721c3f57ec3bfc6a36f6a6a061e94eb9
Opcode Fuzzy Hash: 8994815c00e3edcedd388d433c4596355d862ec9a273bfa7c043287320621a6d
Instruction Fuzzy Hash: 2DE22572619BC886D6718B1AE8813DBB3A1F7CC784F105616EBCD53B69EB38C254CB44

Function 0000000140084D10 Relevance: 13.2, APIs: 4, Strings: 2, Instructions: 2660timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0000000140085040
GlobalMemoryStatusEx.KERNEL32 ref: 000000014008618C

Strings

[UTC, xrefs: 0000000140085013
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140086BBB

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: GlobalInformationMemoryStatusTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC
API String ID: 3306350720-1656529043
Opcode ID: 88edccdf8c60c349649f7c966e70636b7477739be3ee5c1846a077f1be3572f4
Instruction ID: da7cde1e4c36df325f46b883ee3b1e7bb7aa468b29dfdd1f2242004ba60e73bd
Opcode Fuzzy Hash: 88edccdf8c60c349649f7c966e70636b7477739be3ee5c1846a077f1be3572f4
Instruction Fuzzy Hash: 83535833A14BC489EB21CF66E8803DD77A1F389798F515215EB9D17BA9EB78C680C740

Function 000000014007C5E0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000000014007C821
SetFilePointer.KERNEL32 ref: 000000014007C8D4
ReadFile.KERNEL32 ref: 000000014007C903

Strings

ios_base::eofbit set, xrefs: 000000014007CD44
ios_base::badbit set, xrefs: 000000014007CD31, 000000014007CDAF
ios_base::failbit set, xrefs: 000000014007CD3D
exists, xrefs: 000000014007CD8A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 76b0d300dcc5dc83e25f2bab2853cd1525c4b787a105ae7b1070eddc8a3e8d68
Instruction ID: 328364fa54f8b998f16c99ffce34175a0acff490f60ac957cf4cf9dc159f42b2
Opcode Fuzzy Hash: 76b0d300dcc5dc83e25f2bab2853cd1525c4b787a105ae7b1070eddc8a3e8d68
Instruction Fuzzy Hash: 4D320532615BC489EB22CF35D8807DD37A1F789B88F508226EB4D5BAA9EF74C645C701

Function 00000001400C83D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00000001400C8407
LoadLibraryA.KERNEL32 ref: 00000001400C845F
GetProcAddress.KERNEL32 ref: 00000001400C8474
GetCurrentProcess.KERNEL32 ref: 00000001400C847D
VirtualAlloc2.KERNELBASE ref: 00000001400C84AB

Strings

VirtualAlloc2, xrefs: 00000001400C846A
kernelbase.dll, xrefs: 00000001400C8449

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AddressAlloc2CurrentInfoLibraryLoadProcProcessSystemVirtual
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 3240720159-1188699709
Opcode ID: 938162ec5529eeba8205653a98cfbd1f6f15b8febfdf609c6d8605836a059b36
Instruction ID: 63730c23056f03a215a59e9eb8a8fd125be4a83c963abd98b58e6a73959a903e
Opcode Fuzzy Hash: 938162ec5529eeba8205653a98cfbd1f6f15b8febfdf609c6d8605836a059b36
Instruction Fuzzy Hash: 08214832608B8082EB15CB12F448399B7A0F78DB94F644229EF8D07B68EF7CC195CB00

Function 00000001400AA804 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400AA832

Part of subcall function 00000001400A9C94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A9CA8

_get_daylight.LIBCMT ref: 00000001400AA843

Part of subcall function 00000001400A9C34: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A9C48

_get_daylight.LIBCMT ref: 00000001400AA854

Part of subcall function 00000001400A9C64: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A9C78

Part of subcall function 00000001400A47C0: HeapFree.KERNEL32 ref: 00000001400A47D6
Part of subcall function 00000001400A47C0: GetLastError.KERNEL32 ref: 00000001400A47E0

GetTimeZoneInformation.KERNEL32 ref: 00000001400AA87B

Strings

Eastern Summer Time, xrefs: 00000001400AA939
Eastern Standard Time, xrefs: 00000001400AA921

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 1d54ad7d994230515202f367153890dc5f42ca7bd2fd500aa621977fc25ffad9
Instruction ID: 85ecfbda79c0e73f410c84d08ada9f7c1cabc01a9c6d4a0d38c813a6c9e4384e
Opcode Fuzzy Hash: 1d54ad7d994230515202f367153890dc5f42ca7bd2fd500aa621977fc25ffad9
Instruction Fuzzy Hash: AE517E3271064086E722EF27E8917DA77A1F79DBD4F414226FB49436B6DB3CD8818B80

Function 0000000140037AA0 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 797fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0000000140037B7F
FindNextFileW.KERNEL32 ref: 0000000140038366

Strings

filename, xrefs: 000000014003815A
content, xrefs: 000000014003824F
exists, xrefs: 000000014003877A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$exists$filename
API String ID: 1690352074-1949714836
Opcode ID: 28ace9b6107c92aa68a558aa5ad1beb3c7b36bed4ec2abd51dc45932ed0d4516
Instruction ID: 36c423ca68d2ec9e1b5d669f35c9138aa8fb7af6a25f02f0f770b72749934fde
Opcode Fuzzy Hash: 28ace9b6107c92aa68a558aa5ad1beb3c7b36bed4ec2abd51dc45932ed0d4516
Instruction Fuzzy Hash: 7F827D72618BC491EA32DB26E4843DEB361F7897D4F545226EB9D03AB9EF78C584C700

Function 000000014008C9C0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014008CB74
__std_exception_destroy.LIBVCRUNTIME ref: 000000014008CB82
__std_exception_destroy.LIBVCRUNTIME ref: 000000014008CE05
__std_exception_destroy.LIBVCRUNTIME ref: 000000014008CE13

Strings

value, xrefs: 000000014008CA9A, 000000014008CD33

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: b29297cbaed4f81fe5bb13feb918a5aa75ad26a266b74cb0af67e2afe2a42790
Instruction ID: 1c324e3d2b313650e178a08d0d9aef18fd7c303d4f708687a23763897e1a8fdd
Opcode Fuzzy Hash: b29297cbaed4f81fe5bb13feb918a5aa75ad26a266b74cb0af67e2afe2a42790
Instruction Fuzzy Hash: EA027933624B8085EB12DB6AD4807EE6761E7997E4F505212FB9D13AEADB78C285C700

Function 000000014003F2E0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003F32A
Process32FirstW.KERNEL32 ref: 000000014003F36C
Process32NextW.KERNEL32 ref: 000000014003F563
CloseHandle.KERNEL32 ref: 000000014003F7DA

Strings

[PID: , xrefs: 000000014003F3AE

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 961f9aedde160ea31084e78cf52dab166411754cdb94906b58300b3afca6112c
Instruction ID: 8bedfba182fd31f81efca8297a0eab6945c26c842a9c7ac9385bae85902f7b00
Opcode Fuzzy Hash: 961f9aedde160ea31084e78cf52dab166411754cdb94906b58300b3afca6112c
Instruction Fuzzy Hash: 0FE15072614BC485EB22DF26E8803EE67A5F7897E8F504215FB9907BA9DF78C245C700

Function 00000001400856A0 Relevance: 9.0, APIs: 3, Strings: 1, Instructions: 1985COMMON

Download Yara Rule

Strings

%d-%m-%Y, %H:%M:%S, xrefs: 0000000140086BBB

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: %d-%m-%Y, %H:%M:%S
API String ID: 2104809126-3495478971
Opcode ID: b83d7a311b6d5ef24de89597415a87a25ec1d6a7d254fa1504b56249f0e56988
Instruction ID: b9a003495e2c4fd77bd24208fa28c693dbeb3a1295afa42cdf8367591bf1d68e
Opcode Fuzzy Hash: b83d7a311b6d5ef24de89597415a87a25ec1d6a7d254fa1504b56249f0e56988
Instruction Fuzzy Hash: 8B234833A14BC489EB21CF65E8803DD77A5F389798F415215EB8D27BA9EB38C694C740

Function 0000000140089910 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014008995E
OpenProcessToken.ADVAPI32 ref: 0000000140089971
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140089992
AdjustTokenPrivileges.ADVAPI32 ref: 00000001400899D8
CloseHandle.KERNEL32 ref: 00000001400899F8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 8ce77bd8c96780d8ce51cbf27ba3336efb55788d0aa1b2300ace07bcdbe83e4b
Instruction ID: 4cf8d7cf6946ab8fbb0901515b676b160db18f60d30346b27d22caf112023b22
Opcode Fuzzy Hash: 8ce77bd8c96780d8ce51cbf27ba3336efb55788d0aa1b2300ace07bcdbe83e4b
Instruction Fuzzy Hash: 8F211932218B8082E761DB62F44439AB3A4F78CB94F598125FBCA47B68DF7DC595CB40

Function 00000001400CDBC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400ED110: GetCurrentThreadId.KERNEL32 ref: 00000001400ED161
Part of subcall function 00000001400ED110: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400ED180

std::_Throw_Cpp_error.LIBCPMT ref: 00000001400CDED7
std::_Throw_Cpp_error.LIBCPMT ref: 00000001400CDEE2
ReleaseSRWLockExclusive.KERNEL32 ref: 00000001400ED12A

Strings

PLH, xrefs: 00000001400CE086

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Cpp_errorExclusiveLockThrow_std::_$AcquireCurrentReleaseThread
String ID: PLH
API String ID: 3715443949-3073785353
Opcode ID: 6ecfd9981b9ad5889deb0bc4ae55f4649cd77f7bee70f85fb2cea76565bfc338
Instruction ID: 0d2326a337b2591a5d82dbfb44c6707836d3b321d2da7035ac45686461d935b1
Opcode Fuzzy Hash: 6ecfd9981b9ad5889deb0bc4ae55f4649cd77f7bee70f85fb2cea76565bfc338
Instruction Fuzzy Hash: 6A02D372209B8082EB6A9F26D4503ADB7A5F74CBD0F198426EF9D477A4DF38C891D740

Function 0000000140034A50 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 369registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140034DD2

Strings

status, xrefs: 00000001400357A9
exists, xrefs: 00000001400349F2, 000000014003576E
directory_iterator::directory_iterator, xrefs: 0000000140034A14, 000000014003578D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Open
String ID: directory_iterator::directory_iterator$exists$status
API String ID: 71445658-3429586796
Opcode ID: 50447155d7aeea675207f97c81c126e2cbc5b03d8ca3c26eae64252e5d77e6cb
Instruction ID: 2f02d498db14088e1475c0981570f40edbb3fff0825e7a01f05b101b1bca8b63
Opcode Fuzzy Hash: 50447155d7aeea675207f97c81c126e2cbc5b03d8ca3c26eae64252e5d77e6cb
Instruction Fuzzy Hash: CF12F132511BC48AD7728F3AEC813D973A4F789B98F115215EB9C5BBA9EF74C2948700

Function 0000000140064200 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

status, xrefs: 0000000140064F91, 0000000140064FB3, 0000000140064FDB, 0000000140065003
prefs.js, xrefs: 0000000140065762
exists, xrefs: 000000014006660D
cannot use push_back() with , xrefs: 0000000140064F55
directory_iterator::directory_iterator, xrefs: 0000000140064FA3, 0000000140066624

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 59023619d1fbb0ecb895741f53b8938c74b5234f7c35f4ded2cd6ad707780979
Instruction ID: 5600f865e15535318ac1cce559ef59bfa367ecb952a22a4ccb1add8ea77fdc6f
Opcode Fuzzy Hash: 59023619d1fbb0ecb895741f53b8938c74b5234f7c35f4ded2cd6ad707780979
Instruction Fuzzy Hash: 65520532609FC485E6B29B16E8813DBB3A4F789794F505625EBCC43B69EF78C194CB00

Function 000000014003D6E0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000000014003D742
CredFree.ADVAPI32 ref: 000000014003E166

Strings

cannot use push_back() with , xrefs: 000000014003E1B4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 16eed3d09ac2c634e9e0f2f3e1fcd0ca87f160d698d4fbe77977d20ed2fcdafa
Instruction ID: 5f22b537c083bf1cac788d46e21080d69bd4d920d123386015e74aa87762a717
Opcode Fuzzy Hash: 16eed3d09ac2c634e9e0f2f3e1fcd0ca87f160d698d4fbe77977d20ed2fcdafa
Instruction Fuzzy Hash: 00625C72614BC489EB229F65E8803DE77A1F789798F505316EBAC57BE9DB34C284C700

Function 0000000140079F00 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0000000140079F63
ShellExecuteW.SHELL32 ref: 000000014007A5AA

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 527ebb5307d57f4b7e212e7f118ecc967fbc781caa714b251825d70fe873975a
Instruction ID: c8420af9e41f27366b11e00de37b64e1a958fa77d15352177eedb2e7e241ee12
Opcode Fuzzy Hash: 527ebb5307d57f4b7e212e7f118ecc967fbc781caa714b251825d70fe873975a
Instruction Fuzzy Hash: 60121A32625F848AEB418F29E88179EB3A4F789798F505215FFDD57B68EB78C150C700

Function 00000001400799C3 Relevance: 3.3, APIs: 2, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003F2E0: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003F32A
Part of subcall function 000000014003F2E0: Process32FirstW.KERNEL32 ref: 000000014003F36C

Part of subcall function 000000014003D6E0: CredEnumerateA.ADVAPI32 ref: 000000014003D742

Part of subcall function 000000014009AC90: GetSystemTimeAsFileTime.KERNEL32 ref: 000000014009ACA4

ReleaseMutex.KERNEL32 ref: 0000000140079DBF
CloseHandle.KERNEL32 ref: 0000000140079DC8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Time$CloseCreateCredEnumerateFileFirstHandleMutexProcess32ReleaseSnapshotSystemToolhelp32
String ID:
API String ID: 1097652691-0
Opcode ID: 2c37ad0838998b05e8af257d00ab6135a7adaec43c97547c2008d138a361579e
Instruction ID: a2a74e33a4a614950d4d77d204e762c2e1c21c98ec7130849f38241119e4bb88
Opcode Fuzzy Hash: 2c37ad0838998b05e8af257d00ab6135a7adaec43c97547c2008d138a361579e
Instruction Fuzzy Hash: 27C1FD31228AC5A1EA36EB62E8617EE6361F7D93C0F815412B78D439FADE78C605D740

Function 0000000140074DB0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140074E08
LocalFree.KERNEL32 ref: 0000000140074E9A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 5b4fbf053442e25310b53dca1c7b2668b3ec911186700120499bd6f4c1eedf9a
Instruction ID: 135c7ec95b53940c17cbbf9b1810f36f7b91d85426f1845067e7d092456430d2
Opcode Fuzzy Hash: 5b4fbf053442e25310b53dca1c7b2668b3ec911186700120499bd6f4c1eedf9a
Instruction Fuzzy Hash: AE414F32614B80CAE3228F75E4403ED37A5F75878CF084229EB8807E9ADB79C6A4C344

Function 0000000140084A60 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000000140084AD1

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: f6ef34cfcb41f3052617f1b5c8a5d3e54f7dd10a2ea138f4be8893bf6e9d4fff
Instruction ID: 59eb45bd6bd89db07484fda08d55a60b2bbe88f39b2dcf4c39ae8f774b624229
Opcode Fuzzy Hash: f6ef34cfcb41f3052617f1b5c8a5d3e54f7dd10a2ea138f4be8893bf6e9d4fff
Instruction Fuzzy Hash: 49415B33A18B8486E711CF25E8803DEB775F798788F505215EB8823A79DB78D6D1DB40

Function 00000001400837A0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00000001400837E5

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e3501e48ad91f9be64b8ae31702ffbc2359b6fc08940a00fe13bacccd3f58a1a
Instruction ID: bff9526ecac79eb00093fb272be14d47ffcaa7fb24e80faea789edc65b189fb2
Opcode Fuzzy Hash: e3501e48ad91f9be64b8ae31702ffbc2359b6fc08940a00fe13bacccd3f58a1a
Instruction Fuzzy Hash: 45016D3261878082E762CF22F84139AB3A4F79C788F441221FB8D43669DFBCC694CB40

Function 0000000140083EC0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 000000014008411E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 21927da28bed2b5824bdce0af6a90ba1624c9016eaddf5c6f8002ca7b6561857
Instruction ID: 6fed0b75af17e4d9b12073348ca8978edcbc8e1f469df88c925e3bcf7e3ad5b5
Opcode Fuzzy Hash: 21927da28bed2b5824bdce0af6a90ba1624c9016eaddf5c6f8002ca7b6561857
Instruction Fuzzy Hash: 3AC1BC73E18B808AE711CB79D4413ED7761F3997A8F105315FBA817AAADB78C285C740

Function 0000000140045430 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00000001400454B9

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 8703bcf897a27782d48fff385ec9f2f5ba8ce20dd7dcf58d6ef2ee578fa5f6dc
Instruction ID: 42cd7d0efda3bcf5c7685e4c37c0dceadc0e653c82201e953d298c8c2073fda3
Opcode Fuzzy Hash: 8703bcf897a27782d48fff385ec9f2f5ba8ce20dd7dcf58d6ef2ee578fa5f6dc
Instruction Fuzzy Hash: 9041D4736196E04AD702CB3984113BD7FB2D36AB89F1D8162EBD487757D62DC216CB10

Function 000000014003F890 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710eefc1a32d3d71db8811acdd501b8cd42f058edd05b0355d9cb64a42a969e3
Instruction ID: f7768dc746d5d17978b9edb4869cc2116c5de30be9e9877462026c32fa341182
Opcode Fuzzy Hash: 710eefc1a32d3d71db8811acdd501b8cd42f058edd05b0355d9cb64a42a969e3
Instruction Fuzzy Hash: 3C722A72614BC489EB21CB6AE8403DE73A5F78D798F505225EF9C57BA9EB78C240C704

Function 0000000140031B70 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f44c657337b08ee377036b25bb5d79640b31f104f154570ad5791158dbd3576
Instruction ID: eaa65c6b2098ebe0b9555cf3ab03bd59778ed3d545d7eff0d891e1fb3a95b466
Opcode Fuzzy Hash: 1f44c657337b08ee377036b25bb5d79640b31f104f154570ad5791158dbd3576
Instruction Fuzzy Hash: 4DF14F72615B888AEB218B69E44139EB7A4F38C798F105315FFDC57BA9EB78C190C700

Function 0000000140032260 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdfa1fd824669a8ce7abfc55274313c55d23edbdef57b78dd091eb7e2bde0dc
Instruction ID: 7d5fd9b7af191b7d5ca934494fbc2384e4d0555ac01a3c5321da18036afac489
Opcode Fuzzy Hash: 7bdfa1fd824669a8ce7abfc55274313c55d23edbdef57b78dd091eb7e2bde0dc
Instruction Fuzzy Hash: 05F14F72605F888AEB218B69E44139E77A4F78C798F105315FFDC57BA9EB78C1908B00

Function 000000014007C1B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007BF30: InitializeCriticalSectionEx.KERNEL32 ref: 000000014007BF81
Part of subcall function 000000014007BF30: GetLastError.KERNEL32 ref: 000000014007BF8B

EnterCriticalSection.KERNEL32 ref: 000000014007C1F1
GdiplusStartup.GDIPLUS ref: 000000014007C218
LeaveCriticalSection.KERNEL32 ref: 000000014007C226
LeaveCriticalSection.KERNEL32 ref: 000000014007C254
GdipGetImageEncodersSize.GDIPLUS ref: 000000014007C262
GdipGetImageEncoders.GDIPLUS ref: 000000014007C2F6
GdipCreateBitmapFromScan0.GDIPLUS ref: 000000014007C3C0
GdipSaveImageToStream.GDIPLUS ref: 000000014007C3DE
GdipDisposeImage.GDIPLUS ref: 000000014007C443
GdipDisposeImage.GDIPLUS ref: 000000014007C457

Strings

&, xrefs: 000000014007C3BA

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: ee4d62d479441ac8687bbf56f85e9b5e7d012d309e883670cf16dba04190e65e
Instruction ID: eb35c93041dc46072eeefa3f0b6a52ae66cdb76a40e2c66f617e9a05c35dd1de
Opcode Fuzzy Hash: ee4d62d479441ac8687bbf56f85e9b5e7d012d309e883670cf16dba04190e65e
Instruction Fuzzy Hash: A9916232210B809AEB12CF62E840BD937A4F75CBD8F558219EF495BBA5DF38C556C380

Function 000000014007D260 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140082F20: GetUserGeoID.KERNEL32 ref: 0000000140082F47
Part of subcall function 0000000140082F20: GetGeoInfoA.KERNEL32 ref: 0000000140082F61
Part of subcall function 0000000140082F20: GetGeoInfoA.KERNEL32 ref: 0000000140082FB1

WSAStartup.WS2_32 ref: 000000014007D3D9
socket.WS2_32 ref: 000000014007D3FA
htons.WS2_32 ref: 000000014007D420
inet_pton.WS2_32 ref: 000000014007D463
connect.WS2_32 ref: 000000014007D47D
closesocket.WS2_32 ref: 000000014007D49C
WSACleanup.WS2_32 ref: 000000014007D4A2

Strings

geo, xrefs: 000000014007D386
system, xrefs: 000000014007D345

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: c8f47fd9008aba0b0bf81bb5db331c60afb89feab56d0a121a81ed88bd47ecf6
Instruction ID: 775b46702a64bccfd2691c2eabd5ab5d580689fd7a9f3faf070f93931c19a260
Opcode Fuzzy Hash: c8f47fd9008aba0b0bf81bb5db331c60afb89feab56d0a121a81ed88bd47ecf6
Instruction Fuzzy Hash: A7C18A72B01B408AEB12DBA6E4403DC33B2B799BA8F455216EF5D1B6F9DE78C546C340

Function 00000001400A6860 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A6C8D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5f0b478f29d8ffc612cbfcf804fef0a23c1ee2bddfe9812612c20999c88c8e7a
Instruction ID: e28eb35fb5258f0803e956235c3306b3952bb0c2e6f9db3a94696185293a3a24
Opcode Fuzzy Hash: 5f0b478f29d8ffc612cbfcf804fef0a23c1ee2bddfe9812612c20999c88c8e7a
Instruction Fuzzy Hash: 73C1F432214B8482E7639B2694403EE7BB4F7A8BD0F554211FB8A437B1DB78C899CB51

Function 000000014007C010 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000000014007C053
EnterCriticalSection.KERNEL32 ref: 000000014007C065
EnterCriticalSection.KERNEL32 ref: 000000014007C075
GdiplusShutdown.GDIPLUS ref: 000000014007C083
LeaveCriticalSection.KERNEL32 ref: 000000014007C090
LeaveCriticalSection.KERNEL32 ref: 000000014007C09A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 553be29db5892d5f49380c82de3d8774b7a2741da7bcb8a2912f674bad50868d
Instruction ID: e99f7089bb7199b935634657c7b0e7a727dfa9e982def875f740a81c357fdebc
Opcode Fuzzy Hash: 553be29db5892d5f49380c82de3d8774b7a2741da7bcb8a2912f674bad50868d
Instruction Fuzzy Hash: E111E632111B50C1EB159F26E84439973A4FB4CFA8F688215EB5D0B6B4DF39C9A7C780

Function 00000001400BBFA0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400BBFC3
ReadProcessMemory.KERNEL32 ref: 00000001400BBFEC
GetLastError.KERNEL32 ref: 00000001400BC000
VirtualQueryEx.KERNEL32 ref: 00000001400BC01E
ReadProcessMemory.KERNEL32 ref: 00000001400BC04D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Process$MemoryRead$CurrentErrorLastQueryVirtual
String ID:
API String ID: 2584129402-0
Opcode ID: 79c4906e68a013e8855fbbcd168ab546a4d40a596eb9804f0652fb9c821ebf06
Instruction ID: 1b69992e5dff17b4f4da40bbd27df67564cbdda9f8189688c522243e904042ee
Opcode Fuzzy Hash: 79c4906e68a013e8855fbbcd168ab546a4d40a596eb9804f0652fb9c821ebf06
Instruction Fuzzy Hash: 58214D31224B84C2EB619F53E944B9A63A4F75DFC4F484026EF6947BA4CF3CC5568B40

Function 000000014007CDE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014007CE1B
OpenProcessToken.ADVAPI32 ref: 000000014007CE2E
GetTokenInformation.ADVAPI32 ref: 000000014007CE6A
CloseHandle.KERNEL32 ref: 000000014007CE8B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 0133e95664c9947a1615fea2e98d0114d1399641e70fc236894421ad937b8905
Instruction ID: c120e74c45f6954feec9000e0c32128934894e32892969321f026c103d8918dc
Opcode Fuzzy Hash: 0133e95664c9947a1615fea2e98d0114d1399641e70fc236894421ad937b8905
Instruction Fuzzy Hash: 92112832219B8082E7519F16F84038AB3B5F78CB90F549225FB8A47B68CF3CC455CB40

Function 000000014007DD50 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 371networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000000014007E488

Strings

ios_base::badbit set, xrefs: 000000014007E395, 000000014007E3CC, 000000014007E40A
exists, xrefs: 000000014007E373

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: send
String ID: exists$ios_base::badbit set
API String ID: 2809346765-2074760687
Opcode ID: cee6eccf5c5766e6e4eee7aca2fa790389aba71c18a4d45e362c737491c76bb0
Instruction ID: fbcf41cb33cf886197f2c3d6f208218e15caa70da65b08f1b3f1ef185a583249
Opcode Fuzzy Hash: cee6eccf5c5766e6e4eee7aca2fa790389aba71c18a4d45e362c737491c76bb0
Instruction Fuzzy Hash: 89025072219BC181EB22DB16E4943DEB361F7C8794F404226EB8D57ABADF78C945CB40

Function 000000014007E236 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B85D8: RtlPcToFileHeader.KERNEL32 ref: 00000001400B8628
Part of subcall function 00000001400B85D8: RaiseException.KERNEL32 ref: 00000001400B8669

send.WS2_32 ref: 000000014007E488

Strings

ios_base::badbit set, xrefs: 000000014007E395, 000000014007E3CC, 000000014007E40A
exists, xrefs: 000000014007E373

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaisesend
String ID: exists$ios_base::badbit set
API String ID: 2563112387-2074760687
Opcode ID: c2ed9d43995441ba27536c602e0a3a90baa6752a13320ebdcca74d58982504d5
Instruction ID: a8ee2a9e60b47d8aee7a5e935ba98885a4759d5cd52405fd286ea6976c9da585
Opcode Fuzzy Hash: c2ed9d43995441ba27536c602e0a3a90baa6752a13320ebdcca74d58982504d5
Instruction Fuzzy Hash: 89514C72219BC581EB22DB16E4947DEB361F788B94F404126EB8D43AB9EF38C945CB40

Function 0000000140083AC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 0000000140083B29

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0000000140083B1B
ProductName, xrefs: 0000000140083B14

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 10f3d5730bacd1f619464e985ebce9310f6794da947c255d442cd5462389d98d
Instruction ID: a1f06624587d43f7ae67c2568a0a02643dd02c567ead2e6eef59a2ce19c735f5
Opcode Fuzzy Hash: 10f3d5730bacd1f619464e985ebce9310f6794da947c255d442cd5462389d98d
Instruction Fuzzy Hash: E9112E32218B8082E721CF26F4413DAB3A4F79DB98F515216EB9847B69DFBCC155CB44

Function 0000000140084740 Relevance: 4.6, APIs: 3, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000001400847C9
RegEnumKeyExA.ADVAPI32 ref: 000000014008480A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 1e9b86084d8bdee174a8be27c829b56ee5a173848a60e4e3bac61f26fc4f4335
Instruction ID: 6521747bf325620b950c63a1e73399885777397e7c883fcc70dd92c8591e341f
Opcode Fuzzy Hash: 1e9b86084d8bdee174a8be27c829b56ee5a173848a60e4e3bac61f26fc4f4335
Instruction Fuzzy Hash: 29417F36610B8086E721DB66F84039F77B4F789B9CF200215EF9817A64DF78C696D704

Function 0000000140082F20 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 0000000140082F47
GetGeoInfoA.KERNEL32 ref: 0000000140082F61
GetGeoInfoA.KERNEL32 ref: 0000000140082FB1

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: b00e7e739e986762500807f8f5e04299a991fb73d47a4efbdb72625afb2443ee
Instruction ID: 0114351bafe543ef5e12cf760a0bf4141643595d871b09a2397e61347bbe53c7
Opcode Fuzzy Hash: b00e7e739e986762500807f8f5e04299a991fb73d47a4efbdb72625afb2443ee
Instruction Fuzzy Hash: 7811BC32614B9082E7128F62F41079EB3A1F789FC8F445229EF8507B69DF7CD5A08B84

Function 0000000140041CE0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041ECC

Strings

, xrefs: 0000000140041D63

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: c6248cbd749b8fb9113740c94d618af8f05c16656b7b7c1a760c2acf6f8362fa
Instruction ID: 0215979c564baa1ce7b19b2c2cd93dc1ce5f23d6bb933193ac7cb974777c10ba
Opcode Fuzzy Hash: c6248cbd749b8fb9113740c94d618af8f05c16656b7b7c1a760c2acf6f8362fa
Instruction Fuzzy Hash: 23513176704B5496EB168F2BD1943E833A0F788BD4F9A4622EF5D43BA4CB38D4A1C304

Function 00000001400C96C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400C97EE

Strings

nop, xrefs: 00000001400C9D14

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: nop
API String ID: 118556049-258488684
Opcode ID: a5add1cdeed5f4e1a027432ce4be6af6ef39ad8f89b66050ffb776f9863fa767
Instruction ID: 5f2fa283721d2ae6dbc3a3434f7feab96d1567b7c52c41d6837645755762da8c
Opcode Fuzzy Hash: a5add1cdeed5f4e1a027432ce4be6af6ef39ad8f89b66050ffb776f9863fa767
Instruction Fuzzy Hash: 3431743232AB4481EE5ADF5AE1483ADA365E74CBE4F550721FB6D07BE9DB38C4918300

Function 00000001400842D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000000014008430C

Strings

Unknown, xrefs: 00000001400843C6

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: eb8bb11cad4d3131ccbcbe4b686e2d6191aa8fcf1fb8f9e7182e59cf72417813
Instruction ID: f3dd1dc0286e808b9bc1c9952714c3288f4bed050bf4ee3ec12a7dd10c70acb9
Opcode Fuzzy Hash: eb8bb11cad4d3131ccbcbe4b686e2d6191aa8fcf1fb8f9e7182e59cf72417813
Instruction Fuzzy Hash: BC318D33628BC086E712CF22E5403DAA7A0F7D9B84F545215FBC917A6ADB7CC695CB00

Function 0000000140047F00 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140048040
Concurrency::cancel_current_task.LIBCPMT ref: 000000014004813F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 756fed265ab9a502322d58e2f6f43c452a1fc03f6f9c5c4754a914a97ae96ea6
Instruction ID: a44bbe653f3c184eb02baf94212370ed3d67813d2499085d84e7a433cec57a42
Opcode Fuzzy Hash: 756fed265ab9a502322d58e2f6f43c452a1fc03f6f9c5c4754a914a97ae96ea6
Instruction Fuzzy Hash: 8C51D772301B4485FE66AF17A5403EDA265A70CBE4F590A35FF6D0BBF6DA78C5828304

Function 0000000140079B7D Relevance: 3.2, APIs: 2, Instructions: 173synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014009AC90: GetSystemTimeAsFileTime.KERNEL32 ref: 000000014009ACA4

ReleaseMutex.KERNEL32 ref: 0000000140079DBF
CloseHandle.KERNEL32 ref: 0000000140079DC8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Time$CloseFileHandleMutexReleaseSystem
String ID:
API String ID: 3470202250-0
Opcode ID: e4957c476c70d80dc7007f0ea1b13938ce2f403441f39d5d900b85267e093034
Instruction ID: 1fe3c545806ebd97c12d5cb1fe6ba6fe759d14d06c70f0d1609a6006f225b478
Opcode Fuzzy Hash: e4957c476c70d80dc7007f0ea1b13938ce2f403441f39d5d900b85267e093034
Instruction Fuzzy Hash: F6810E71229AC5A1FA36EB62E4613EE6361F7D9380F815412F78D839FADE38C605D740

Function 000000014007C490 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000000014007C4E9
CoTaskMemFree.OLE32 ref: 000000014007C5AA

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: b895cc07a9e23feb0bbcc074bf2cbf8293525a50f489b84e1fd3092d33876636
Instruction ID: e824e461b1720e75a0dfebf3b15ef6afed269678eedee92f623a6a5cb8054f00
Opcode Fuzzy Hash: b895cc07a9e23feb0bbcc074bf2cbf8293525a50f489b84e1fd3092d33876636
Instruction Fuzzy Hash: A6317372A14B8481E6218F2AE48139AB761F79DBE4F505315FBAD036E9DB7CD181CB40

Function 00000001400925CC Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400925F3

Part of subcall function 0000000140092580: _invalid_parameter_noinfo.LIBCMT ref: 0000000140092597

_invalid_parameter_noinfo.LIBCMT ref: 00000001400926A7

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4db28ec5cc50d85a6b518035f2d6b552d0c87938a9db18554e7d210b234c6b03
Instruction ID: 5cf4d21046219c100f600baba8d18e247524c5065477eb75dba901216e42e0c8
Opcode Fuzzy Hash: 4db28ec5cc50d85a6b518035f2d6b552d0c87938a9db18554e7d210b234c6b03
Instruction Fuzzy Hash: C331BC32211E4482EA56EF16E8503EE27A1E79CBD0F950621FB4A877F2EF38C545C750

Function 0000000140079DAD Relevance: 3.1, APIs: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 0000000140079DBF
CloseHandle.KERNEL32 ref: 0000000140079DC8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexRelease
String ID:
API String ID: 4207627910-0
Opcode ID: ac8f2be21034c045886fdd6f502ae8944def2a628781ea578a717de4401527f4
Instruction ID: 2585ba79eeab76385b9cb1724404b487d6135586fa7784c16ed06155a65a0052
Opcode Fuzzy Hash: ac8f2be21034c045886fdd6f502ae8944def2a628781ea578a717de4401527f4
Instruction Fuzzy Hash: CA316D32319AC451EA36E766E4513ED5320EBC97D0F921511B79D83AFADE38C944D700

Function 000000014007AB30 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007AB81
RegCloseKey.ADVAPI32 ref: 000000014007AB93

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 6ae50c345f7c926d1b02f4959d51d4f18b5f64e2feb57a0c2af95bfb0d20111a
Instruction ID: d7b42f5001f6c1af208d0f689fd7ef8b1fbb4ca170c97ef3e882d1654eb70388
Opcode Fuzzy Hash: 6ae50c345f7c926d1b02f4959d51d4f18b5f64e2feb57a0c2af95bfb0d20111a
Instruction Fuzzy Hash: 4B21B176714A8486EA529B23E8403EAA361EB9DBD4F080121FB4D43BAADF3CC481C700

Function 00000001400A6DD0 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00000001400A6E1C
GetLastError.KERNEL32 ref: 00000001400A6E26

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fa5c7f9d9058102a339b1f8801f6c71374a1739474c7be3f72ee9b3e1220e4dc
Instruction ID: 671a5dc06a19ca0a11daa611c1ba398c180862c44a3aeb7022999e8bf90c3ee8
Opcode Fuzzy Hash: fa5c7f9d9058102a339b1f8801f6c71374a1739474c7be3f72ee9b3e1220e4dc
Instruction Fuzzy Hash: A9118C76214B8081DA21CB26E404399A761A799FF4FA44321EF794B7F9CF78C4918B40

Function 00000001400B5FD8 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400B6008

Part of subcall function 00000001400B702C: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400B7035

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400B600E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 700c0b634ef59ceaedef228731b8f5f3f8ef2add7014226fde75a431e4dcd748
Instruction ID: c850d4b8387a95d24154a7e50f96293d8b982511e9814b9b0963d0d666d058ef
Opcode Fuzzy Hash: 700c0b634ef59ceaedef228731b8f5f3f8ef2add7014226fde75a431e4dcd748
Instruction Fuzzy Hash: EAE01271611A0A52FD6B3AF319163F500A01B5D7F0E2C1B317B790B6F3E938C4514110

Function 00000001400A47C0 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00000001400A47D6
GetLastError.KERNEL32 ref: 00000001400A47E0

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: abaf095cda3fb664b3aa4b8c8c2c8800b2f27dab971ce25a3c5a706c4b96f9de
Instruction ID: b9cf273ec3f396947780959eb0fc174e4428e3efb4c2778611c947b75282a271
Opcode Fuzzy Hash: abaf095cda3fb664b3aa4b8c8c2c8800b2f27dab971ce25a3c5a706c4b96f9de
Instruction Fuzzy Hash: 6FE08C3471460082FB1BABB358843ED22906B9CB81F404424EF0187372EF3CC89A8B60

Function 000000014007A6D0 Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014007A862

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a52bb7b663653f5cd5d257c23122b807e5ad285ed50158e5bb3aa1df81eadd85
Instruction ID: ecaa9bbab553b941262ccfb755707fed13bfe3718f3649872d07a409c21c9b7d
Opcode Fuzzy Hash: a52bb7b663653f5cd5d257c23122b807e5ad285ed50158e5bb3aa1df81eadd85
Instruction Fuzzy Hash: 37B18C72614B8485EB229B66E8403DDB3A1F389BE4F544226EBAD47BE9DF7CC541C700

Function 00000001400912A0 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400914F0

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 81d2c94ac63dcc18a231ffe994dcc7e400903d3fd5ea5219455a13adbd8b57fb
Instruction ID: e923d7b93dc559887fe3d1cb908467676f50fbedf3ead9206042c307493a8309
Opcode Fuzzy Hash: 81d2c94ac63dcc18a231ffe994dcc7e400903d3fd5ea5219455a13adbd8b57fb
Instruction Fuzzy Hash: 77616B72301A4085EA56DE17D1543ED23A2A78DFD8F548522EF6E0B7E5DB38C996D300

Function 00000001400309E0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 0000000140030B13

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: bf51f6d7fd8e2e3bdf75314707d59c6feeced78481be4fc0df31b52447198b64
Instruction ID: 6d5d1d0862526a0d31bc334c8d32ba5ce922f56cabfa845a83eaf9d6dffc67ef
Opcode Fuzzy Hash: bf51f6d7fd8e2e3bdf75314707d59c6feeced78481be4fc0df31b52447198b64
Instruction Fuzzy Hash: A2619F72B11B4489FB12DF6AD4A13EE63A1E7487E8F404621FF29576E9EB74C891C340

Function 0000000140048820 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400489B5

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 57697e2c69ead7598fbaf9902ecdeee700c9acab3395400a05c04394560d5b57
Instruction ID: 099d03fc9fbd044c087de85713d771da5c9ef7c441c54ff2eb62576810160ffb
Opcode Fuzzy Hash: 57697e2c69ead7598fbaf9902ecdeee700c9acab3395400a05c04394560d5b57
Instruction Fuzzy Hash: 0341AE72304B8485EA229F17A5043ED6362B74DBD4F590A36EFAD0B7E5DF38C4419304

Function 000000014006DF10 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006E0B7

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3edaca2d7d918dc96f08eef791e6921c08f65591e45db6303a5c7873b2f19460
Instruction ID: 49411311e4f40978be9b5c1adc78f72e49a7261ae0a2c5839112a3ce39a6a975
Opcode Fuzzy Hash: 3edaca2d7d918dc96f08eef791e6921c08f65591e45db6303a5c7873b2f19460
Instruction Fuzzy Hash: B2416472215B8481DA25DB56E5543AEB3A2F74CBD4F644A26FB9D03BE5DF78D180C300

Function 00000001400838E0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000140083970

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 4ff824a1036e8c4152957ca1fd3bb64c1b572cbfa7bf2992e2c20c99bbe22cea
Instruction ID: abbf9b3b53cb059d6ceb25a0589b592dea01dc6ccbdd2843847a2e6e3ed9e198
Opcode Fuzzy Hash: 4ff824a1036e8c4152957ca1fd3bb64c1b572cbfa7bf2992e2c20c99bbe22cea
Instruction Fuzzy Hash: 11518D33A14B8089E712CF69E4403DE77B1F799798F505216EB8C53AA9DF78C684CB40

Function 00000001400489D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140048B4C

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4db105f778cecee01dccafdfc7a409303a8731910e77489f2c66cd98c4869c9f
Instruction ID: 186352a12e0ec3ab26c4ddb95a53f663efcce4c7a672fd1f35fa56ebbdccd7eb
Opcode Fuzzy Hash: 4db105f778cecee01dccafdfc7a409303a8731910e77489f2c66cd98c4869c9f
Instruction Fuzzy Hash: 1C41B4B2301B4085FE22AB17A5043DDA261A70CFD4F544A36BFAD0BBEADB78C551D308

Function 0000000140043970 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140043AC1

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 53501b18b33ea2c2df05a2e43c8791499f6862c0140c5414e61e82f7c5c63722
Instruction ID: f877c517ea345ddad51710348d22e4b67905cd0aa4790dcf9d8df79c6d3c61de
Opcode Fuzzy Hash: 53501b18b33ea2c2df05a2e43c8791499f6862c0140c5414e61e82f7c5c63722
Instruction Fuzzy Hash: AB315572341A8444FE17AB57A5043E962519708FE4F551631AFAD07BE5DA78C8A1C305

Function 00000001400A4CC0 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A4CE8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d288ce3a8f59af22e61a658f6af3622335df89bf5086d992f7d666a51fee3126
Instruction ID: d45ff301d93a0a6ad1dda03a6a5f980fc7342ead855659d60abf79a3401cfb68
Opcode Fuzzy Hash: d288ce3a8f59af22e61a658f6af3622335df89bf5086d992f7d666a51fee3126
Instruction Fuzzy Hash: ED41D33650160487EB769B1AE5413ED73A0F7AEBD4F100700FB9A87AA1CB38C482CF50

Function 00000001400427F0 Relevance: 1.6, APIs: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400428F8

Part of subcall function 000000014002DF10: __std_exception_copy.LIBVCRUNTIME ref: 000000014002DF58

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: cbddd59b39bcde846bdd7686305480a3ab935663c9f686f1096dcb87b5714990
Instruction ID: ca25ff53475a00518b37f067765100a45f2b2db2fa0f3b2748d9285c98a0ab28
Opcode Fuzzy Hash: cbddd59b39bcde846bdd7686305480a3ab935663c9f686f1096dcb87b5714990
Instruction Fuzzy Hash: FB21F732B02B4041EA1AAB57A1003EC6390E758BE4F654635AB7C03BE5EF74C4D29340

Function 00000001400A6740 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A67C6

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6a424a1862e252f104d98a22ed7854e0b12ee2544baf2a2213fde03138f9aae
Instruction ID: 4fe7cc40cfb7f67c371b291c45df8c3aea62e4ebee3d8730d08d53175f6e0aae
Opcode Fuzzy Hash: d6a424a1862e252f104d98a22ed7854e0b12ee2544baf2a2213fde03138f9aae
Instruction Fuzzy Hash: D6317332624A1086F753AF6788413DD2AA0A7ACFE4F524705FF25433F2DB78C8858B51

Function 00000001400DCCA0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32 ref: 00000001400DCD8C

Part of subcall function 00000001400DC560: UnmapViewOfFile.KERNEL32 ref: 00000001400DC570
Part of subcall function 00000001400DC560: UnmapViewOfFile.KERNEL32 ref: 00000001400DC581

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FileUnmapView$CriticalDeleteSection
String ID:
API String ID: 1429322562-0
Opcode ID: 4c0bf50b2a727a2101c6b768742399a8d0290827343191bf247b63edcd83cbbf
Instruction ID: 41288b734cfb8dc33bbe86ab0af6438ede10a126c7020dbf475728731d007889
Opcode Fuzzy Hash: 4c0bf50b2a727a2101c6b768742399a8d0290827343191bf247b63edcd83cbbf
Instruction Fuzzy Hash: 2431363A221B8186DB11DF22F94079E77A4FB8CBD8F481125EF8907B69DB34D4A6C744

Function 00000001400F1B08 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400F1B2B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 70bf896b561adad378154b5a9aa75eb806a5c363bda8e4fba91d540825785324
Instruction ID: 5bafcba1e62b3082370db88932d25df161f6278ca1b8f6e810314a96c73da679
Opcode Fuzzy Hash: 70bf896b561adad378154b5a9aa75eb806a5c363bda8e4fba91d540825785324
Instruction Fuzzy Hash: 37219332214A40C7DB668F2AE4503E977A1E7C8BD4F644328FB59876E9EB79C804DB00

Function 00000001400EFCD4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400EFC31

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b874b2431c390e4c3ce94b2b4c494386b5c7e2e88d760d95cc96ba2d081e1a
Instruction ID: 263c9cda12cb91749fe8f543c702ad6afa19bc897db33f61c26c0a2499e220c7
Opcode Fuzzy Hash: 61b874b2431c390e4c3ce94b2b4c494386b5c7e2e88d760d95cc96ba2d081e1a
Instruction Fuzzy Hash: 0111B43260568482FA629F1395003FEA3A0BB9CBD0F644411FF8467BB6DB79C841AB80

Function 00000001400DC4B0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00000001400DC4C4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6d2310d077955d8aea653d85a9e0a070073bd4ce5a7b7d11e752ffe5c3d7ecfc
Instruction ID: 5ade576dcb295f6fb2a063f81e72e710f541aa216f93e8c0a0f6aaef15d68fad
Opcode Fuzzy Hash: 6d2310d077955d8aea653d85a9e0a070073bd4ce5a7b7d11e752ffe5c3d7ecfc
Instruction Fuzzy Hash: 81F0F931B14A458BE759CB2EA8A575E77E1F38DB50F404129EA4EC37A4DA78D811CB80

Function 0000000140038323 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140038366

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 023abc5ec8dec306f4c56b2b1cb79829ee1d5b09c77f80c48eebe4a5235393d5
Instruction ID: 916901330867d0dfe20c482d9b3c55cb0011bbf2fc08e5374fa40ce508c4e27b
Opcode Fuzzy Hash: 023abc5ec8dec306f4c56b2b1cb79829ee1d5b09c77f80c48eebe4a5235393d5
Instruction Fuzzy Hash: 9C01FB36208A8591EB72DB52F49439BA364F78CBD4F444062DF8D43B69DF38C9868B00

Function 0000000140092CE4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140092D03

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bfd1af2436c86cf97cc9b7188a38bc2e51aa77262de0214f2f9b059f75a9b1dc
Instruction ID: 5ebbe111e64410ebfb43f8954264de602eda507447c5268e5f7e2101aa4843e1
Opcode Fuzzy Hash: bfd1af2436c86cf97cc9b7188a38bc2e51aa77262de0214f2f9b059f75a9b1dc
Instruction Fuzzy Hash: 74E09231216A4581EB666BB692413ED71A09F4C7F0F544721BB38473E6DB3484944A00

Function 00000001400EB4F0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400EB4F4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 53218ea80e347e6865bdeee8b0f03a3a5d87b1e304366d91bc4bbfa512aed3a1
Instruction ID: 9b5e6f58aa60bf1f9a65a2c51a85c8418ac0a6c6a263a3f6e363abf871b6f5f1
Opcode Fuzzy Hash: 53218ea80e347e6865bdeee8b0f03a3a5d87b1e304366d91bc4bbfa512aed3a1
Instruction Fuzzy Hash: F3C0923AF16E01D2E65E6B736C8638211E0B79CB50F804020C30489270DA3CC5F78B12

Function 00000001400ED0E4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400ED0ED

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 31ef5172387b0c087c3910bc7c9ebda6b906d006f82425aae53580b4b20e881b
Instruction ID: 195818b1730fd8767b9becd48dfcc062d8b727c5d88d13d7c9a9ef3ab51c705c
Opcode Fuzzy Hash: 31ef5172387b0c087c3910bc7c9ebda6b906d006f82425aae53580b4b20e881b
Instruction Fuzzy Hash: 35B09236A148C0C3D612FB04E8422597331F7A8B08FD00000E38D42A24CE2CCA6A8F00

Function 00000001400DCE70 Relevance: 1.4, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400DC4B0: GetSystemInfo.KERNEL32 ref: 00000001400DC4C4

InitializeCriticalSection.KERNEL32 ref: 00000001400DCF40

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CriticalInfoInitializeSectionSystem
String ID:
API String ID: 3396500325-0
Opcode ID: dc4482ca8e0435746fbe169b04928ad9b92026c57d372a0786afd09550947472
Instruction ID: 2fb64b4282a8f1b64c4c4bfdaae2ed1b3b081738ca54b7fedf115f8fa7aef408
Opcode Fuzzy Hash: dc4482ca8e0435746fbe169b04928ad9b92026c57d372a0786afd09550947472
Instruction Fuzzy Hash: 66418072A10B848AD711DF16E440B8EBBE8FB68BD0F558029EF9943B61DB78D991C710

Function 00000001400A4E28 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001400A4E7D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 93459845f911a6eca184272eb9e7dca726b4e6dbea886ee78a2622d72edc0e7b
Instruction ID: 1179846723eaab30ef03143abf8af47316f73c8bd90fd5250d0693c77c49fae6
Opcode Fuzzy Hash: 93459845f911a6eca184272eb9e7dca726b4e6dbea886ee78a2622d72edc0e7b
Instruction Fuzzy Hash: 09F01D7930160481FF5A9AA754513E952946BECBC0F4C4621AB0A87BF2EA7CC9D54A21

Function 00000001400A714C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001400A718A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4ecfee661c4bf62e861df5f9f5e7a1dae78cf794a289f64c5eca19dba9fd3138
Instruction ID: 7f061c4fc7af9fe7d15eec8060caa2f5ffb02fa2745e3ffd5e5be5faf2d163ee
Opcode Fuzzy Hash: 4ecfee661c4bf62e861df5f9f5e7a1dae78cf794a289f64c5eca19dba9fd3138
Instruction Fuzzy Hash: 3AF01C3530164545FA6A6AA75C51BE917D05B9CBE0F488B24BF2A877E2EA3CC4818A11

Function 00000001400DC530 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00000001400DC53C

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: dac610213d391720b387916774ff12a690399de04c291ef470cfe5691dd3be78
Instruction ID: a30d538c320d85756b3924851d18014e3fee224cfc40024ffd3029a3d046797d
Opcode Fuzzy Hash: dac610213d391720b387916774ff12a690399de04c291ef470cfe5691dd3be78
Instruction Fuzzy Hash: E4C04C20B1595052FB4CA32B5C5B35650926FCC701FD48438DA0FC6664E92CC9564A00

Non-executed Functions

Function 0000000140088390 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00000001400883D3
NtAllocateVirtualMemory.NTDLL ref: 000000014008840B
lstrcpyW.KERNEL32 ref: 000000014008846D
lstrcatW.KERNEL32 ref: 0000000140088522
NtAllocateVirtualMemory.NTDLL ref: 00000001400885A9
lstrcpyW.KERNEL32 ref: 000000014008865C
RtlInitUnicodeString.NTDLL ref: 0000000140088671
RtlInitUnicodeString.NTDLL ref: 0000000140088686
LdrEnumerateLoadedModules.NTDLL ref: 0000000140088699
RtlReleasePebLock.NTDLL ref: 000000014008869F

Part of subcall function 000000014007C490: SHGetKnownFolderPath.SHELL32 ref: 000000014007C4E9
Part of subcall function 000000014007C490: CoTaskMemFree.OLE32 ref: 000000014007C5AA

CoInitializeEx.OLE32 ref: 000000014008874A
lstrcpyW.KERNEL32 ref: 0000000140088929
lstrcatW.KERNEL32 ref: 0000000140088B2E
CoGetObject.OLE32 ref: 0000000140088B4C
lstrcpyW.KERNEL32 ref: 00000001400891C9
lstrcatW.KERNEL32 ref: 00000001400893EC
CoGetObject.OLE32 ref: 000000014008940A
CoUninitialize.OLE32 ref: 00000001400898D2

Strings

0, xrefs: 000000014008900A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: ec4978b4f81629be8347dd7426a940c08cdfaad56eb610a502adb52037f94c9e
Instruction ID: e7456d8b1e3284507225bf031802b11ad8d03af14e141c3a26d73a6d94ec8cad
Opcode Fuzzy Hash: ec4978b4f81629be8347dd7426a940c08cdfaad56eb610a502adb52037f94c9e
Instruction Fuzzy Hash: 0DC2A536626F848AD7918F69E88169EB3B5F788B88F105219FFCD57B18EF38C1548740

Function 0000000140007460 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

bootmgr, xrefs: 000000014000783E
gdipfontcachev1.dat, xrefs: 0000000140007697
autorun.inf, xrefs: 0000000140007488
winsipolicy.p7b, xrefs: 0000000140007598
ntuser.dat.log, xrefs: 000000014000760D
ntuser.ini, xrefs: 0000000140007639
boot.sdi, xrefs: 00000001400077B1
ntuser.dat, xrefs: 00000001400075E4
mib.bin, xrefs: 0000000140007724
reagent.xml, xrefs: 000000014000780F
bootsect.bak, xrefs: 0000000140007526
bootfont.bin, xrefs: 0000000140007500
indexervolumeguid, xrefs: 0000000140007753
winre.wim, xrefs: 00000001400077E0
thumbs.db, xrefs: 0000000140007668
BOOTNXT, xrefs: 000000014000786D
desktop.ini, xrefs: 000000014000754C
wpsettings.dat, xrefs: 0000000140007782
iconcache.db, xrefs: 00000001400075BE
bootmgfw.efi, xrefs: 00000001400074D9
boot.ini, xrefs: 00000001400074B1
d3d9caps.dat, xrefs: 00000001400076C6
ntldr, xrefs: 0000000140007572
bootstat.dat, xrefs: 00000001400076F5

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: 54d700b9cf3b2f1ca1d9d49bc365dd1e4e44872a710e548b6f8f77ba2ac0658b
Instruction ID: 527f8b79ed6ac165eb26ffec9e934a133d46b85231917469a4c0808525d83b5c
Opcode Fuzzy Hash: 54d700b9cf3b2f1ca1d9d49bc365dd1e4e44872a710e548b6f8f77ba2ac0658b
Instruction Fuzzy Hash: 11C12362D64FC985F722DB35D8927E95321F7EE384F5063067A886686AABB4D3C4C340

Function 000000014004F570 Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140050BF1
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140050C9F

Part of subcall function 000000014002E1B0: __std_exception_copy.LIBVCRUNTIME ref: 000000014002E1F3

Part of subcall function 00000001400B85D8: RtlPcToFileHeader.KERNEL32 ref: 00000001400B8628
Part of subcall function 00000001400B85D8: RaiseException.KERNEL32 ref: 00000001400B8669

Strings

", xrefs: 000000014004FA63
/, xrefs: 000000014004F862
unexpected '}', xrefs: 0000000140050CCC
No closed word, xrefs: 0000000140050BF7, 0000000140050C1E
word wasnt properly ended, xrefs: 0000000140050CA5
key opened, but never closed, xrefs: 0000000140050C78
key declared, but no value, xrefs: 0000000140050B3D, 0000000140050B64, 0000000140050C51
#include, xrefs: 000000014004FF49
*, xrefs: 000000014004F88D
object is not closed with '}', xrefs: 0000000140050AEF
#base, xrefs: 000000014004FF75
Unexpected eof, xrefs: 0000000140050AC2
unexpected key without object, xrefs: 0000000140050BCA
quote was opened but not closed., xrefs: 0000000140050B16, 0000000140050B8B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 34f6616089c1b5d85326b0f588a7cd64029c40379e88d2a05ca38019efe8194e
Instruction ID: 1fd2bdae82e2677d3299bf680e003309f46a3562e66fee7289a7b504b5679022
Opcode Fuzzy Hash: 34f6616089c1b5d85326b0f588a7cd64029c40379e88d2a05ca38019efe8194e
Instruction Fuzzy Hash: 70D27C72201BC489EB72DF26D8943ED23A1F749BD8F449126EB4D1BAA9DF74C685D300

Function 0000000140051070 Relevance: 24.1, APIs: 2, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140052781
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140052856

Strings

key declared, but no value, xrefs: 00000001400526CD, 00000001400526F4, 0000000140052808
#include, xrefs: 0000000140051ADA
unexpected '}', xrefs: 0000000140052883
No closed word, xrefs: 0000000140052787, 00000001400527AE
object is not closed with '}', xrefs: 000000014005267F
#base, xrefs: 0000000140051B06
Unexpected eof, xrefs: 0000000140052652
unexpected key without object, xrefs: 000000014005275A
quote was opened but not closed., xrefs: 00000001400526A6, 000000014005271B
word wasnt properly ended, xrefs: 00000001400527D5, 000000014005285C
key opened, but never closed, xrefs: 000000014005282F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-1838291449
Opcode ID: eb900d71ade9e2f6b82f7c326de3f4711fff6f9eb988d53f1e69666dadd6b078
Instruction ID: 03013754f389e8e0bba62caefda1a5e29651623dfed84ff8f3aa32f0e6b1e7f6
Opcode Fuzzy Hash: eb900d71ade9e2f6b82f7c326de3f4711fff6f9eb988d53f1e69666dadd6b078
Instruction Fuzzy Hash: D8E27D72201BC589EB72DF26D8543ED63A1F789BD8F449112EB4D0BAA9DF79C685C300

Function 00000001400782D0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 0000000140078857

Strings

runas, xrefs: 00000001400787D6
ios_base::eofbit set, xrefs: 0000000140078A7C
.exe, xrefs: 000000014007841D
open, xrefs: 00000001400787CD
.vbs, xrefs: 00000001400783C2
ios_base::badbit set, xrefs: 0000000140078A6A
ios_base::failbit set, xrefs: 0000000140078A75
.ps1, xrefs: 0000000140078364
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0000000140078464
.exe, xrefs: 0000000140078335
.cmd, xrefs: 0000000140078393

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: b736ccdf428926acdbc3589d1661301ddbb1df8be5a9b612d7e5297685105340
Instruction ID: 507abe47d6672312e4aed87257e284537349760d18f6cc79123d83b8ba698f03
Opcode Fuzzy Hash: b736ccdf428926acdbc3589d1661301ddbb1df8be5a9b612d7e5297685105340
Instruction Fuzzy Hash: 4222AD72A10B8489EB21DF2AE8803DD67A1F789798F505216FF9D07AB9DF78C584C740

Function 00000001400C6C00 Relevance: 18.8, Strings: 14, Instructions: 1262COMMON

Download Yara Rule

Strings

mov, xrefs: 00000001400C6DC9
byte, xrefs: 00000001400C6F29
invalid map<K, T> key, xrefs: 00000001400C81AB
eax, xrefs: 00000001400C6DE6, 00000001400C6EAB
rax, xrefs: 00000001400C6DDF
r14, xrefs: 00000001400C79B4
word, xrefs: 00000001400C6ED3
Unexpected scratch register: , xrefs: 00000001400C784A
Failed to detect pointer size: , xrefs: 00000001400C70DB
r15, xrefs: 00000001400C75CC, 00000001400C7969, 00000001400C79BB
Unexpected register: , xrefs: 00000001400C7FA1
dword, xrefs: 00000001400C6E0C
Unexpected size of immediate: , xrefs: 00000001400C7506
qword, xrefs: 00000001400C6CE9

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: Failed to detect pointer size: $Unexpected register: $Unexpected scratch register: $Unexpected size of immediate: $byte$dword$eax$invalid map<K, T> key$mov$qword$r14$r15$rax$word
API String ID: 0-2329226126
Opcode ID: b898597e394676c54ace9a110c6494a51de0979dec9d23d00f0fdaec8550e1fb
Instruction ID: 8390165515701400da8e46bdd47a1d46d0cf007b02affc282317bca7447e9be8
Opcode Fuzzy Hash: b898597e394676c54ace9a110c6494a51de0979dec9d23d00f0fdaec8550e1fb
Instruction Fuzzy Hash: 0CD28D72614BC489EB268F3AC8447DD2361F79A7E8F515312EB6D07AEADB74C681C340

Function 00000001400886E0 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140088390: RtlAcquirePebLock.NTDLL ref: 00000001400883D3
Part of subcall function 0000000140088390: NtAllocateVirtualMemory.NTDLL ref: 000000014008840B
Part of subcall function 0000000140088390: lstrcpyW.KERNEL32 ref: 000000014008846D
Part of subcall function 0000000140088390: lstrcatW.KERNEL32 ref: 0000000140088522

CoInitializeEx.OLE32 ref: 000000014008874A
lstrcpyW.KERNEL32 ref: 0000000140088929
lstrcatW.KERNEL32 ref: 0000000140088B2E
CoGetObject.OLE32 ref: 0000000140088B4C
lstrcpyW.KERNEL32 ref: 00000001400891C9
lstrcatW.KERNEL32 ref: 00000001400893EC
CoGetObject.OLE32 ref: 000000014008940A
CoUninitialize.OLE32 ref: 00000001400898D2

Strings

0, xrefs: 000000014008900A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 46856a67f9d735cf3640d6ed0888d38c7fdb031285a706985f8aba05ff74bb73
Instruction ID: 52311d9c48f45b6e631d904fbf878860f439d2d73c19143f580cb39edb632a84
Opcode Fuzzy Hash: 46856a67f9d735cf3640d6ed0888d38c7fdb031285a706985f8aba05ff74bb73
Instruction Fuzzy Hash: 3CB28736626F948AD7918F69E88169EB3B4F788788F106215FFCE57B18EF38C1548740

Function 000000014003A5AD Relevance: 13.9, Strings: 9, Instructions: 2667COMMON

Download Yara Rule

Strings

status, xrefs: 000000014003BA47
config, xrefs: 000000014003A9BD
key, xrefs: 000000014003C00D, 000000014003C1ED
filename, xrefs: 000000014003A826, 000000014003ABAE, 000000014003B442, 000000014003C609, 000000014003D1C9
content, xrefs: 000000014003A87F, 000000014003AC07, 000000014003B524, 000000014003C782, 000000014003D36F
users, xrefs: 000000014003AF42
exists, xrefs: 000000014003CB87, 000000014003CBA2, 000000014003D687
files, xrefs: 000000014003C905
directory_iterator::directory_iterator, xrefs: 000000014003CBF4, 000000014003D6A3

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: config$content$directory_iterator::directory_iterator$exists$filename$files$key$status$users
API String ID: 3645842244-2219949686
Opcode ID: 67b6fd72f6af48243323258f7b2dffbf886e6f6c736e59aea6dcc426e4eda430
Instruction ID: 141750884d7518ca2ad1e587602aa72160b98357eb534dff312151c5f6506920
Opcode Fuzzy Hash: 67b6fd72f6af48243323258f7b2dffbf886e6f6c736e59aea6dcc426e4eda430
Instruction Fuzzy Hash: 1A535B72614BC489DB229F36D8843DE73A1F789798F405216EB9D4BBA9EF74C684C340

Function 00000001400B0350 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A1208: GetLastError.KERNEL32 ref: 00000001400A1217
Part of subcall function 00000001400A1208: FlsGetValue.KERNEL32 ref: 00000001400A122C
Part of subcall function 00000001400A1208: SetLastError.KERNEL32 ref: 00000001400A12B7

TranslateName.LIBCMT ref: 00000001400B03BA
TranslateName.LIBCMT ref: 00000001400B03F5
GetACP.KERNEL32 ref: 00000001400B043C
IsValidCodePage.KERNEL32 ref: 00000001400B0474
GetLocaleInfoW.KERNEL32 ref: 00000001400B0631

Strings

utf8, xrefs: 00000001400B0558

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 8c84162eab8dbe6ad326fd3655602cdebf6bcd3c6b83614ec67febf4e5201166
Instruction ID: 97a7229884e5b30bfaa28901e9727aa55fa34c00c91b71d340f10d9569cd6bea
Opcode Fuzzy Hash: 8c84162eab8dbe6ad326fd3655602cdebf6bcd3c6b83614ec67febf4e5201166
Instruction Fuzzy Hash: 6B916D32200B4086EB26EFA3D4513EA27B5F79CBC4F448221EF5957BA5DB38C991CB40

Function 00000001400CE500 Relevance: 9.3, Strings: 7, Instructions: 525COMMON

Download Yara Rule

Strings

1to64, xrefs: 00000001400CEBDF
1to4, xrefs: 00000001400CEB6A
align, xrefs: 00000001400CE838
1to32, xrefs: 00000001400CEBC9
1to8, xrefs: 00000001400CEB7A
1to2, xrefs: 00000001400CEB57
1to16, xrefs: 00000001400CEBB3

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: 1to16$1to2$1to32$1to4$1to64$1to8$align
API String ID: 0-1990294269
Opcode ID: 478a5ba8a10261c43c710e93d119ad108c814f434cc3ec5caa3a0798475301f4
Instruction ID: 7c63153baf6e9d2c5b38c954df07048833b2cfb378f205e1196e899562564f23
Opcode Fuzzy Hash: 478a5ba8a10261c43c710e93d119ad108c814f434cc3ec5caa3a0798475301f4
Instruction Fuzzy Hash: 7722D17671C7D486FB6A8A2BD4507EE27A1E349BC4F405512FF8A436E5DB38C946CB00

Function 00000001400675D0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140067784
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140067792
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140067A15
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140067A23

Strings

value, xrefs: 00000001400676AA, 0000000140067943

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: e09b87fb67f8119ec36d9110f5ffdd435aa0169bf59fc6cc9ee6f89b467fb22a
Instruction ID: b94e9466bba14b55e70aa40608e9d4094cc79ae4d18756597f06ca01627c55c5
Opcode Fuzzy Hash: e09b87fb67f8119ec36d9110f5ffdd435aa0169bf59fc6cc9ee6f89b467fb22a
Instruction Fuzzy Hash: 41029F32624BC085EB12DB76D8807ED6761E7997E4F606612FB9D03AEADF78C185C700

Function 00000001400938D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140093951
RtlLookupFunctionEntry.KERNEL32 ref: 0000000140093969
RtlVirtualUnwind.KERNEL32 ref: 00000001400939A4
IsDebuggerPresent.KERNEL32 ref: 00000001400939DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001400939E7
UnhandledExceptionFilter.KERNEL32 ref: 00000001400939F2

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: faa6f7e622c5208679f333b5150aea54d47808ff57d7d9691893f837b2f58faa
Instruction ID: f236aa8944d41e0e4c6ef317a3f33f8b34e9fac6cb0e43c73d851ef4ced4813d
Opcode Fuzzy Hash: faa6f7e622c5208679f333b5150aea54d47808ff57d7d9691893f837b2f58faa
Instruction Fuzzy Hash: 6A314836214B8086EB658F26E8503EE73A4F78DB98F500126EB9D47BA9DF38C5558B00

Function 00000001400EDBBC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400EDC1D
IsDebuggerPresent.KERNEL32 ref: 00000001400EDC35
OutputDebugStringW.KERNEL32 ref: 00000001400EDC46

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400EDC3F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 054003f83320035adec44d53329f05feb58a978b0ff87314a16bb39900f58930
Instruction ID: 09c35e770ad39213f50f7636fb780a3f872189017728483d935ec7ab857520c4
Opcode Fuzzy Hash: 054003f83320035adec44d53329f05feb58a978b0ff87314a16bb39900f58930
Instruction Fuzzy Hash: 84113C32210B81A7F71ADB23EA543E932A4FB4C795F408125D75987A70EF78D475C750

Function 000000014006B810 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000014006BA6E

Strings

parse_error, xrefs: 000000014006B89E
value, xrefs: 000000014006C793

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: ddd3c1a74a86c349b8309c4abc749f886e4cf66e3c5f3df43a90582154fde3e1
Instruction ID: ac181b44541d7d9b686985c1003e569a6c5bcad8f1508312d4bbefea5c153520
Opcode Fuzzy Hash: ddd3c1a74a86c349b8309c4abc749f886e4cf66e3c5f3df43a90582154fde3e1
Instruction Fuzzy Hash: D8F1BD72710A8499EB12DF76E8403ED6362FB997D8F505612BB4C57ABAEF74C184C340

Function 000000014008C090 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000014008C273

Strings

out_of_range, xrefs: 000000014008C102
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 000000014008C39F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$out_of_range
API String ID: 592178966-2497706888
Opcode ID: 345b567ba06255e8cf68ed98e33fedb532958b79e3616f20d4ca6a5419dd0ab9
Instruction ID: 5c27f8ba16959ba3c19418828fdc6b0aa3e7cb5b094244fe15b80a78c521cb22
Opcode Fuzzy Hash: 345b567ba06255e8cf68ed98e33fedb532958b79e3616f20d4ca6a5419dd0ab9
Instruction Fuzzy Hash: 21A1C273B25B8089EB02CB6AD4457EC6771E7597D8F109212EB5D17BE9DA78C289C300

Function 00000001400C1BC0 Relevance: 5.4, Strings: 4, Instructions: 370COMMON

Download Yara Rule

Strings

xchg [rsp], rax, xrefs: 00000001400C1E0F
mov rax, , xrefs: 00000001400C1C68, 00000001400C1CD5
push rax, xrefs: 00000001400C1C12
ret , xrefs: 00000001400C1E67, 00000001400C1ED4, 00000001400C2009

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: mov rax, $push rax$ret $xchg [rsp], rax
API String ID: 0-2795999732
Opcode ID: 22a3ed4ff4778e56e1143d0db0bf7f853427a89fe8e1f00fc171382c6a496d08
Instruction ID: 7b5411fcf73a3a9b23e9f7f1d722205e7d2174d65b75ea7364a9c1f298938797
Opcode Fuzzy Hash: 22a3ed4ff4778e56e1143d0db0bf7f853427a89fe8e1f00fc171382c6a496d08
Instruction Fuzzy Hash: 2DE1BA72A04B8096FB1ADB66D8403DD6361F78EBD8F409615EF5C17AAADB78C196C300

Function 00000001400EB1A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400EB1C6
FormatMessageA.KERNEL32 ref: 00000001400EB1F9

Strings

!x-sys-default-locale, xrefs: 00000001400EB1B9

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: d44032de10bca517d3cc3a61524fc6b25f9580e9f75d891d10e8f21147b91806
Instruction ID: 5eacaf96aef8882ba7608a1ba89a06efd4eb2271f755527e7c87f1542b75ba00
Opcode Fuzzy Hash: d44032de10bca517d3cc3a61524fc6b25f9580e9f75d891d10e8f21147b91806
Instruction Fuzzy Hash: 8401927270478482E7668B53F4507EEA7A2F78CBE9F548125EB4557AB8DB3CC904C740

Function 00000001400735A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

WjDTVsOqYQE=, xrefs: 00000001400736D1
BNJ2CJKQ5Zf0mOfwwSyvVLKXc+5QJhazkBSDvjVtCBU=, xrefs: 0000000140073649
port, xrefs: 000000014007425F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: BNJ2CJKQ5Zf0mOfwwSyvVLKXc+5QJhazkBSDvjVtCBU=$WjDTVsOqYQE=$port
API String ID: 0-3598645580
Opcode ID: 47dd90bbc6747c894ac1b97bc8c31a994622e9d68482a245637b3a4c4f5cd498
Instruction ID: f3277c25d16ceec83d3e6fa77c53580f5979ae8a18b246afc58aabb247082d01
Opcode Fuzzy Hash: 47dd90bbc6747c894ac1b97bc8c31a994622e9d68482a245637b3a4c4f5cd498
Instruction Fuzzy Hash: 7E724CB2629BC485EB61CB25E4803DEB3A4F799784F105215EBCD13BA9EF78C195CB04

Function 0000000140038B60 Relevance: 3.8, Strings: 2, Instructions: 1345COMMON

Download Yara Rule

Strings

Software, xrefs: 0000000140038FDE, 00000001400391B6
exists, xrefs: 000000014003A128

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 16587b24968a8745b9de4b858f6ad7cf5c9980102582367a87451ccbf63b19c2
Instruction ID: 7d57a894eb3b2c33bb14fe447fa03a7420b02576c1fbcd5077147db542657528
Opcode Fuzzy Hash: 16587b24968a8745b9de4b858f6ad7cf5c9980102582367a87451ccbf63b19c2
Instruction Fuzzy Hash: 60D25D72A14BC48AEB22CF6AD8403DE73A0F799798F105615EB9D57BA9DF78C580C700

Function 00000001400A5418 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00000001400A548C

Strings

GetLocaleInfoEx, xrefs: 00000001400A5434, 00000001400A5445

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: ccc1f16d2b9fc2463dee01d2f619e68b1c413d3b13c2f6d01cda35fd49cc1089
Instruction ID: f9189aa88e5a79659cf07438a99c10eacb6fbc2dd1a2603e9a95673d7650527e
Opcode Fuzzy Hash: ccc1f16d2b9fc2463dee01d2f619e68b1c413d3b13c2f6d01cda35fd49cc1089
Instruction Fuzzy Hash: A3016235704A50C5E746AB97B4407CAA760FB9CFD0F588126FF4A17BB5CE38C5858740

Function 0000000140058150 Relevance: 3.5, APIs: 2, Instructions: 491COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400581CA
Concurrency::cancel_current_task.LIBCPMT ref: 000000014005825B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e09b51e03cc1b0a6b09e8d05fe46dbb4b710d009b02beed2b085046692401718
Instruction ID: b70ad2e8686e9360b28231a381164296a6a10e2675fa54fca6b3afe16d2750e5
Opcode Fuzzy Hash: e09b51e03cc1b0a6b09e8d05fe46dbb4b710d009b02beed2b085046692401718
Instruction Fuzzy Hash: 5F129D72701B8585EB21DBA6D0403EE63A5E74CBD8F544A22AFAD277E9EF35C491C340

Function 00000001400DB540 Relevance: 3.2, Strings: 2, Instructions: 739COMMON

Download Yara Rule

Strings

AMD, xrefs: 00000001400DBE59
enticAMDINTEL, xrefs: 00000001400DB560

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: AMD$enticAMDINTEL
API String ID: 0-2549603476
Opcode ID: aed62507083fa553c5f2539b65d02b82734244c10abe3d0a9424441d8330d52a
Instruction ID: 230005b85510d9f42276c9476dbd1c88ec7ddc2541c38de8726fbd0babce1d59
Opcode Fuzzy Hash: aed62507083fa553c5f2539b65d02b82734244c10abe3d0a9424441d8330d52a
Instruction Fuzzy Hash: D532C0F3B21A9847EA888A19DC6A3AC66D1F3583C0F45913EEA5BC7795ED3DC521C340

Function 00000001400A8B08 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00000001400A8D57
RaiseException.KERNEL32 ref: 00000001400A8D68

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a218957482b48b590648b3e16ace9b7ac7afc45119c2de734ba3a03728b764a2
Instruction ID: c8d34fb6e0955f51f3407ef158d4a3df27c7fe6055741d62ff455f56a5d04356
Opcode Fuzzy Hash: a218957482b48b590648b3e16ace9b7ac7afc45119c2de734ba3a03728b764a2
Instruction Fuzzy Hash: 47B12E77611B848BEB6ACF2AC44639C7BA0F358B98F158915EF59877B4CB39C491CB00

Function 0000000140083BA0 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 0000000140083CB7
EnumDisplayDevicesW.USER32 ref: 0000000140083D5B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: 6872b2a1775001889eaac118a2615336a6bb25534a215a71294fe19b33a49d7c
Instruction ID: 1b2c0a1f8d6145ee5efbe52447604fa085a41442bca38fb426272f1ebc199d5c
Opcode Fuzzy Hash: 6872b2a1775001889eaac118a2615336a6bb25534a215a71294fe19b33a49d7c
Instruction Fuzzy Hash: 74818A32614B8486E721CF26E8447DEB7A5F388798F505225FF9917BA9DF78C681CB00

Function 0000000140038910 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000000014003899D
LocalFree.KERNEL32 ref: 0000000140038A2F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 0c80f4035d07f9ae65cd5118a55bf493c65ea56425deab33a29bebc7b189084f
Instruction ID: 3629de925e708f7d235f9a823d34145797d5ceceb6765a8558dc5691f8a7ddd4
Opcode Fuzzy Hash: 0c80f4035d07f9ae65cd5118a55bf493c65ea56425deab33a29bebc7b189084f
Instruction Fuzzy Hash: AB616932B14B809AF722DFB6E4503DD73A1E75878CF04822AEF8917E99DB78C5949344

Function 00000001400750D0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 0000000140075128
LocalFree.KERNEL32 ref: 00000001400751BA

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 52960f018f6b1f12d67629b669ec63dfa0ea14dc44592252fcec820f30678a9d
Instruction ID: d266c87285c6aa47a68fd3a6794154060c5dc46c359d747faafdc1d6a747fedb
Opcode Fuzzy Hash: 52960f018f6b1f12d67629b669ec63dfa0ea14dc44592252fcec820f30678a9d
Instruction Fuzzy Hash: 57416432614B80CAE3219F75E4503ED37A4F75978CF480229FB8807E9ADBB9D6A4C344

Function 0000000140075760 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

+, xrefs: 0000000140075DDF
%, xrefs: 0000000140075DC4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: c576036bef250c6d9aeaf198f55c3b79ab8f34911bb87dc6ebb851549a33a90d
Instruction ID: f59017eac44669c63a7bf1e0e8e8c92d58a59f95a4aae23eacc6e38cbde463df
Opcode Fuzzy Hash: c576036bef250c6d9aeaf198f55c3b79ab8f34911bb87dc6ebb851549a33a90d
Instruction Fuzzy Hash: 40223432B14AC48AFB22DBA6E4403ED67A1E7597D9F444222EF491BBE9DB7CC445C340

Function 00000001400CFB20 Relevance: 3.0, Strings: 2, Instructions: 492COMMON

Download Yara Rule

Strings

rel, xrefs: 00000001400CFDE4
abs, xrefs: 00000001400CFDD4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: abs$rel
API String ID: 0-1867029159
Opcode ID: a473d4a40322626fd3db14bdbe02dfedb8dc11f491bf41f379a2da7ce227cca6
Instruction ID: b5f9e17065c3f9dcb0fd7e4c63201054ddd99d02d629610e7083f34bd25fade7
Opcode Fuzzy Hash: a473d4a40322626fd3db14bdbe02dfedb8dc11f491bf41f379a2da7ce227cca6
Instruction Fuzzy Hash: 2B122336B147588AFB668F6AD4403FE37A2EB4D3C8F414016EF8A577A4CA34C9439751

Function 0000000140032890 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

emoji, xrefs: 0000000140032900
dumps, xrefs: 00000001400328D8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: 03d82e907adee68b22686eebad63fddba16452c3aae65b08851797fce799e95a
Instruction ID: 09a2759293876dc9420d299c4148c98b0444dc9b18f15e46000af0c59aa81e9f
Opcode Fuzzy Hash: 03d82e907adee68b22686eebad63fddba16452c3aae65b08851797fce799e95a
Instruction Fuzzy Hash: 54B1FA32928BC486D661CB26E88039EB7A4F79D784F116315FBCD13B59EB38D294CB00

Function 00000001400C89E0 Relevance: 1.9, APIs: 1, Instructions: 407COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400C8B2C

Part of subcall function 00000001400B5FD8: Concurrency::cancel_current_task.LIBCPMT ref: 00000001400B6008
Part of subcall function 00000001400B5FD8: Concurrency::cancel_current_task.LIBCPMT ref: 00000001400B600E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0b69c36c95c395237da12dc3d0d624995e8983e6af879255586cf49c6e3f7a6a
Instruction ID: bb84be2ed8b7e4b2bf14284c8570d4baf5ca8858a27998a792c994b87870921b
Opcode Fuzzy Hash: 0b69c36c95c395237da12dc3d0d624995e8983e6af879255586cf49c6e3f7a6a
Instruction Fuzzy Hash: 9BE1E372309B8481EA26CB67E5503A9A7A5F74CBD4F188526FF9D17BA9DF38C441C304

Function 000000014009D7E0 Relevance: 1.8, APIs: 1, Instructions: 338COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009D820

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a6b9e59de1a42d85cf5c78fb29ab3d3937db4af33a05dca5261f04ba76ee7ada
Instruction ID: 3203e973b6185ee152bfd999f43640f08a69961489cba11cb878d8efb18f6228
Opcode Fuzzy Hash: a6b9e59de1a42d85cf5c78fb29ab3d3937db4af33a05dca5261f04ba76ee7ada
Instruction Fuzzy Hash: FCD1BF32244A4485EB66DE2AC4413AE73E0F708BE4F594617AB69833F5DF34C8A5C351

Function 000000014006F830 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006FB44

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 92c371ff8c98cc1660d6c0c85229ff54015da03a94d7c75bd7110a8e5e98be2c
Instruction ID: 3906679b3c222f42c2983a54b5d66573796697f25481cea48895773088d6acd3
Opcode Fuzzy Hash: 92c371ff8c98cc1660d6c0c85229ff54015da03a94d7c75bd7110a8e5e98be2c
Instruction Fuzzy Hash: 2BA19B32715B9889EB01CBAAD8903EC77B1F359B88F644816EF8D57B69DB38C191C350

Function 000000014006FB50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006FE64

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: af48ab863644eba9c53a3bcbf901b2ac65b0de9835582d2f1dd6a355bb2245ea
Instruction ID: 93b714cf98a21b768632bebe7a0bd67af16f29415553b032fac939e71d89933e
Opcode Fuzzy Hash: af48ab863644eba9c53a3bcbf901b2ac65b0de9835582d2f1dd6a355bb2245ea
Instruction Fuzzy Hash: B0A17A33615B9889EB01CB6AD8803EC7BB1F359B88F648816EF8D57B65DB38C191D350

Function 000000014006F500 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006F829

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 718e958c70c832b7d9e1c6424f0de8eeeee4f73d74ccf3431f42866a1bf977d3
Instruction ID: 9de4b7d66a2436df27872a36a948ffacbc78897ec1d268066673ffc1e9c57ce7
Opcode Fuzzy Hash: 718e958c70c832b7d9e1c6424f0de8eeeee4f73d74ccf3431f42866a1bf977d3
Instruction Fuzzy Hash: 0FA16A32615B9889EB01CBBAD8803EC77B1F359B88F644516EF8E57B69DB78C095D300

Function 000000014006F200 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006F4F8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9889526f2195ebbbeb1454bce7de8e811286a7aacae513597e7b242e5a15b405
Instruction ID: 7367c3776fe654be5bebd888e0ea0ad4bea57bf6cd8bed69d2732d8f4ba40b51
Opcode Fuzzy Hash: 9889526f2195ebbbeb1454bce7de8e811286a7aacae513597e7b242e5a15b405
Instruction Fuzzy Hash: 44A19D32711B9889EB02CBAAD8803EC77B1F359B88F644816DF8D57B65DB38C191D350

Function 00000001400701A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140070498

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6ed2b688b07d8cd9cd83b674e3a5ee6bcc546fd94892a0d008e6a052c08c04ed
Instruction ID: b48390c816428d89045c1e04f6a370e73fe8442dd2fa12dff4fd166578e17986
Opcode Fuzzy Hash: 6ed2b688b07d8cd9cd83b674e3a5ee6bcc546fd94892a0d008e6a052c08c04ed
Instruction Fuzzy Hash: 9CA15572611B98CAEB02CBAAD4803EC67B0F359B88F548516EF8D57BA5DB38C195C350

Function 00000001400B06AC Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A1208: GetLastError.KERNEL32 ref: 00000001400A1217
Part of subcall function 00000001400A1208: FlsGetValue.KERNEL32 ref: 00000001400A122C
Part of subcall function 00000001400A1208: SetLastError.KERNEL32 ref: 00000001400A12B7

EnumSystemLocalesW.KERNEL32 ref: 00000001400B074A

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: d31b0e8b878ea9c9ad4684d0a2280a69be4b223fb2a9ea9fc38e501018a57506
Instruction ID: 575f1d782025ffba70ea757e2318b07ebe91ab5e1badddfa315d6dff9f172b34
Opcode Fuzzy Hash: d31b0e8b878ea9c9ad4684d0a2280a69be4b223fb2a9ea9fc38e501018a57506
Instruction Fuzzy Hash: D911D277A08A448AEB16CF56D0807D977B0E398FE0F448215E725473E0CA74C5E2CB40

Function 000000014005C6B0 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

., xrefs: 000000014005C9B0

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 5c9ebf230e739041059a005dacacb947caf5ad859c155fb820512693fe771ff2
Instruction ID: 26c742df555e69aaad3492150474e7d4bf53c26861829c66d4d47b37d5743d41
Opcode Fuzzy Hash: 5c9ebf230e739041059a005dacacb947caf5ad859c155fb820512693fe771ff2
Instruction Fuzzy Hash: 07C18E36214B858AEB62CF26D4447E963E1F38DBD8F544212FB9953BA9DF3AC841C740

Function 00000001400B077C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A1208: GetLastError.KERNEL32 ref: 00000001400A1217
Part of subcall function 00000001400A1208: FlsGetValue.KERNEL32 ref: 00000001400A122C
Part of subcall function 00000001400A1208: SetLastError.KERNEL32 ref: 00000001400A12B7

EnumSystemLocalesW.KERNEL32 ref: 00000001400B07FA

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 7a2050fe495426a8a9bf94d902fe583815080089f9fe196a5e32f26c1e775371
Instruction ID: 86c17577c9b09a49ae2dae1ac44f90fba32e1aa6f54559803de660ddcf62af16
Opcode Fuzzy Hash: 7a2050fe495426a8a9bf94d902fe583815080089f9fe196a5e32f26c1e775371
Instruction Fuzzy Hash: F001D472F0868086E7168F57E840BD9B7F1E758BE4F459322E761476E4CB749884CB00

Function 000000014007209A Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00000001400720FD
CoSetProxyBlanket.OLE32 ref: 0000000140072152

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: BlanketCreateInstanceProxy
String ID:
API String ID: 1899829610-0
Opcode ID: e397ba13e5da6171ba6e43d035164001f5d4af7bca0c688c2b5f5464109aa0a4
Instruction ID: 93f3887a1dbab9a9c1804a0694ff39c59bfca8b71274630949810c7725e6463a
Opcode Fuzzy Hash: e397ba13e5da6171ba6e43d035164001f5d4af7bca0c688c2b5f5464109aa0a4
Instruction Fuzzy Hash: BE016232701A448AFB23DB66E4013ED6375B74C798F4001169F4947AA5DB38C195C344

Function 00000001400CAB70 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

invalid unordered_map<K, T> key, xrefs: 00000001400CADE7

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: invalid unordered_map<K, T> key
API String ID: 0-353222475
Opcode ID: 21d4b7b73097c22cab228e67454e5c85da2e425a306aa68bafc98f4c06aacf7d
Instruction ID: d3dbacfc0049dd4b458d2a8d0d4729fe98672d08288237b7e35cebe8ddd558f5
Opcode Fuzzy Hash: 21d4b7b73097c22cab228e67454e5c85da2e425a306aa68bafc98f4c06aacf7d
Instruction Fuzzy Hash: 5381DF73315B8485FF1A8B62D4613EDA7A5E78DBC8F459112BB9E0BBE8DA3CC5418340

Function 00000001400296B0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7001790b5711a0340eb057828507806ff5fdfc41ea56a93dd152039bdeeb3fb6
Instruction ID: af439ed8e967c6f3e3a5971302ed57229e5c351cd322188aef6ef2817abd0f68
Opcode Fuzzy Hash: 7001790b5711a0340eb057828507806ff5fdfc41ea56a93dd152039bdeeb3fb6
Instruction Fuzzy Hash: 6DA29136615FC88AD7418FAAEC8129D73B6F748BA8B101629EFCC57F18EBB4C1558740

Function 0000000140026800 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2c2324655f72607c14d0a350bd068353971557772658129cc7c5e7556c5d08
Instruction ID: 38d9243cb0ea6d0b9924b5464c521dbeed4fd27af0a3d3299834404c2a74d1ec
Opcode Fuzzy Hash: fe2c2324655f72607c14d0a350bd068353971557772658129cc7c5e7556c5d08
Instruction Fuzzy Hash: 41929532915BC88AD7718F25E8813DAB7A8F79D788F505315EACC27B59EB38C3548B04

Function 00000001400DA840 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa96472d91caff97ddf0c644458283babda909e3ea7a388ce69eb2861f763d0d
Instruction ID: db2f462f7aae13de209ce98ec11809e87f1e7abd5e4e0cb75693bdfb5f266d3e
Opcode Fuzzy Hash: aa96472d91caff97ddf0c644458283babda909e3ea7a388ce69eb2861f763d0d
Instruction Fuzzy Hash: 3752FFB220468482FBBB8A1BD1507FA6691A79D3E4F140526FF46A7BF0C679CDC1C780

Function 00000001400EE4B0 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d4d767bbbaaf6fc642392a77769fc2c7124bc08782bf1337f65d91400a68ab
Instruction ID: c4334eddfe5f29bc47e6d803e947b934d16647c84fd65b6c8757047ccbb32c7e
Opcode Fuzzy Hash: b7d4d767bbbaaf6fc642392a77769fc2c7124bc08782bf1337f65d91400a68ab
Instruction Fuzzy Hash: 31525031625E988AE2938F77AC117A56724BB5EBD0F418B13FA0E77675DF38C8438640

Function 00000001400592D0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47d2fc46064dab5907b35485465ac6e09d969a0ee3f7e69edd6212c471c0128
Instruction ID: 7d19a591d459c6a9a3cc4d6037e9a3430a3eaa0e78a92297d4af63f38d9ab00b
Opcode Fuzzy Hash: f47d2fc46064dab5907b35485465ac6e09d969a0ee3f7e69edd6212c471c0128
Instruction Fuzzy Hash: 99C1E07372569487EB5ACF62D9447A9B762F3D8BD0F45D121EB4A07B98CB38C806CB00

Function 00000001400078F0 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12dea1d706b177d03b5a5233ae31bb246803a981e0301ca9b34e363946891f9f
Instruction ID: ebd1c84cfa7831731e7b7c66a8de33334c72d0bd705e410faca9fd6448cd9e44
Opcode Fuzzy Hash: 12dea1d706b177d03b5a5233ae31bb246803a981e0301ca9b34e363946891f9f
Instruction Fuzzy Hash: DD12B332919FC88AD7718F29E88139AB3A4F79D788F105315EACC57B59EB38C254CB04

Function 00000001400277F0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7129b1f32dc77fc5c098c71d0b6e4732fc2b5b69e35b3c4f1554bc109b4373a
Instruction ID: 9d402ecd76f078c7c18ea3b59632e3730846ab53a2efcb9625fd70632bc245fe
Opcode Fuzzy Hash: b7129b1f32dc77fc5c098c71d0b6e4732fc2b5b69e35b3c4f1554bc109b4373a
Instruction Fuzzy Hash: 8A02C332915BC489D7628F39E8813DDB7A4F7AD788F105215EACC6BB69EB74C294C700

Function 00000001400949B4 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction ID: 55f202f5c4cbe0222ca74a06564f8e578e2c9a1c86f38f431d48fb0c1e51abe4
Opcode Fuzzy Hash: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction Fuzzy Hash: 869168363156844AFFAA8E2B9050BFE1690B75D7D8F040228FF6A477F4DA38C905DB04

Function 00000001400DA820 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51fe987ad81019e8bd64efbd13c1aa75b05fe3203f31444a0409f3678010c71f
Instruction ID: 8a0cbf317469ca454b68b861748f78de0b118a11b645de994bd8acfdc088539c
Opcode Fuzzy Hash: 51fe987ad81019e8bd64efbd13c1aa75b05fe3203f31444a0409f3678010c71f
Instruction Fuzzy Hash: 79916BB2710A5046FA228B1BB5007EA6791F798BE4F984121FF9857FE4DB38C995C7C0

Function 000000014009B810 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f6bb7b5d3fa898bc405ad412104628d63f6b5283c79ac35f5da9429fb73f32a9
Instruction ID: 40cad65316457eb926279f9f3c5539095ba2bc1da1b24c1618d4ccf7f934d0c7
Opcode Fuzzy Hash: f6bb7b5d3fa898bc405ad412104628d63f6b5283c79ac35f5da9429fb73f32a9
Instruction Fuzzy Hash: CE819E72600A5086EB65CF6AD5813AD23A4F788BE8F148626FF2E97BA4CF34C441C740

Function 0000000140008000 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf60a5878d10fb45bb922aa4434284bfb4a8850ce500248e9bf54e3d3a20baed
Instruction ID: 0f6fdf05d5e6cf645631da8abc4e08efda21388d6c5ea843b43454cce3b2d700
Opcode Fuzzy Hash: bf60a5878d10fb45bb922aa4434284bfb4a8850ce500248e9bf54e3d3a20baed
Instruction Fuzzy Hash: 70B1E532915FC48AD711CF6AE88029DB7B5F7997A8F105225EBCC63B69EB78C154C700

Function 00000001400F1BCC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 96dee636877c4981823ff604cc05051f0ce0167f6762f4337eb515c1ee7efdad
Instruction ID: 4f513cbfe54e5cb7a864329eeb3260d3622950bf244a87185f65c53baa309a0f
Opcode Fuzzy Hash: 96dee636877c4981823ff604cc05051f0ce0167f6762f4337eb515c1ee7efdad
Instruction Fuzzy Hash: DF61073270428046F7678A3B94707FD66A1A7D87F0F28062DFB26877F5E6B5C840A740

Function 00000001400730F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7712bce75c303a6c128dfa0d45a2675bbe9045de200c46ed45cf77d95598a9a8
Instruction ID: 3482827fc97d760e4ef7964667bf2eb1a29b1004a8a33d58c04a2bd9e3514fbe
Opcode Fuzzy Hash: 7712bce75c303a6c128dfa0d45a2675bbe9045de200c46ed45cf77d95598a9a8
Instruction Fuzzy Hash: 1C61CE2321E2C48BD30EDF7C589106D7F61D3A7908788469DEA85EBB4BC514C91ACBA6

Function 000000014007B8B0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115ec3479d1ced52aff82e296fd1bbc7adb168330e899e859c1048ac23d30de2
Instruction ID: c3f83bafca21749d4975f1de029164259a3540273bc347dfa2f251f45a4f7e74
Opcode Fuzzy Hash: 115ec3479d1ced52aff82e296fd1bbc7adb168330e899e859c1048ac23d30de2
Instruction Fuzzy Hash: C051E4B3B0568443DB248B49F842796F7A5FB987C5F00A126EE8D57B68EB3CD5918700

Function 0000000140098ABC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: e1c81d8c3366b32db4f0f5afe8ba6307c1f37b86d88d2687b4f65627c1590916
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: CE5180B6225A5486EB768F2AC0547A837A0E74CFE8F289111EF49577B4C736DC53CB40

Function 00000001400B32E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8c08d7308113fb21a23596271e587e6057e87f3d6b82481ecb8894e85f4e57f2
Instruction ID: be0f3e8d2111afdee6c35086d553d8a418ec12143c3aa421ba8b101de76ab97e
Opcode Fuzzy Hash: 8c08d7308113fb21a23596271e587e6057e87f3d6b82481ecb8894e85f4e57f2
Instruction Fuzzy Hash: 7B418E72310A5482EF05CF6BE9543A9A3A2B74CFD4F59A126EF4D87B68DF38C5428340

Function 000000014009F384 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f002881efd8788ee020ebe9b5287b6ed930f04522113ec59c3e42dca390c035a
Instruction ID: 796c22431e34fd2ff2d603bb7e78a2f43fac52e7d2ba8bd11467b371b31b1131
Opcode Fuzzy Hash: f002881efd8788ee020ebe9b5287b6ed930f04522113ec59c3e42dca390c035a
Instruction Fuzzy Hash: 8F31DF3231419086FABB9A2B95147FB1642E78E7C0F34C421B71503EF9CA768992B701

Function 000000014009F268 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3cb59ec0bf7899867bf851bf667cf51092c67ae8703a3e64bec9bc61aabe119
Instruction ID: aff53f4ff4f2b174ba21e90ca2eb6ab86ce19de7f79930c6b5604f2b9dd5fbca
Opcode Fuzzy Hash: d3cb59ec0bf7899867bf851bf667cf51092c67ae8703a3e64bec9bc61aabe119
Instruction Fuzzy Hash: BE31A53635414086FAB7A63F85557FE1252A7CF3C0E74C011B71503EFAC93ACA46B601

Function 0000000140112008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction ID: 5c881259407823a677f806ac6b828a465a2f54a170d86803f77e28e98f2a5628
Opcode Fuzzy Hash: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction Fuzzy Hash: A1F0C277E1D7D05AF35B56250C7E3C42F9193AEF22F4D414EEB808B5E394568C26D201

Function 0000000140112310 Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction ID: a5422d421867a1635294d0e5104aa643561a9748f9593c14bbaf006d3816dd87
Opcode Fuzzy Hash: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction Fuzzy Hash: A1F0FFBBA6FED006F2AF95250D393882ED1B7BDB05F5D408ACB640B2A3A415AC149211

Function 00000001401123D0 Relevance: .0, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e423b98e04b3c157fb954ab798d349e3d320fa6f3d3355e1b75ce666253ff21c
Instruction ID: e9a707f030eaf1c8e60f4e8112ea2724b6024718075de571551b5f405e6fd695
Opcode Fuzzy Hash: e423b98e04b3c157fb954ab798d349e3d320fa6f3d3355e1b75ce666253ff21c
Instruction Fuzzy Hash: ADE06DB7A6EAD40AF31B42610C7F7481ED2677EF11F4C808FC794072E3A48CAC149212

Function 0000000140112300 Relevance: .0, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3cb19ce9efaf2b46e79e0a51ba7a8244bb1ba91189e2c0121fb46574d7054f
Instruction ID: 3e52525d39e57bbbd7167a3d2a5026f39e520ea7036a62e7442895414421d68b
Opcode Fuzzy Hash: 2a3cb19ce9efaf2b46e79e0a51ba7a8244bb1ba91189e2c0121fb46574d7054f
Instruction Fuzzy Hash: 7DA002DBE99384ABCB1609700CE14E91F1679B2900395505EE351D33D3BC8D0A0B9522

Function 0000000140112728 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction ID: 6057e0744044de1f339b24c16bfdf157061ff175f0d0f28b74e805da65e585af
Opcode Fuzzy Hash: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction Fuzzy Hash: 61A01273304094D7F1070A1100053843750D367B40F888050C60006547C024041D8A00

Function 0000000140112090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction ID: 0af80ac6c70e3a750504ab6f60a9205e365a9efaf323507a39ae21047495f09e
Opcode Fuzzy Hash: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction Fuzzy Hash:

Function 00000001400A1208 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400A1217
FlsGetValue.KERNEL32 ref: 00000001400A122C
FlsSetValue.KERNEL32 ref: 00000001400A124D
FlsSetValue.KERNEL32 ref: 00000001400A127A
FlsSetValue.KERNEL32 ref: 00000001400A128B
FlsSetValue.KERNEL32 ref: 00000001400A129C
SetLastError.KERNEL32 ref: 00000001400A12B7
FlsGetValue.KERNEL32 ref: 00000001400A12ED
FlsSetValue.KERNEL32 ref: 00000001400A130C

Part of subcall function 00000001400A4E28: HeapAlloc.KERNEL32 ref: 00000001400A4E7D

FlsSetValue.KERNEL32 ref: 00000001400A1334

Part of subcall function 00000001400A47C0: HeapFree.KERNEL32 ref: 00000001400A47D6
Part of subcall function 00000001400A47C0: GetLastError.KERNEL32 ref: 00000001400A47E0

FlsSetValue.KERNEL32 ref: 00000001400A1345
FlsSetValue.KERNEL32 ref: 00000001400A1356

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 7c967122ad4d7ecad4dbaaf56d21964e2454bb0f298830798979b60159b840d5
Instruction ID: 28a98054ec12b254c2af60400c7c344744b63fad456a2dcf43f32cb271e4fbc2
Opcode Fuzzy Hash: 7c967122ad4d7ecad4dbaaf56d21964e2454bb0f298830798979b60159b840d5
Instruction Fuzzy Hash: 6F417A3120424046FE6FA76369513ED12826BEDBF1F580724BB364BAF2EE78D9C14B40

Function 0000000140077B00 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140077B7D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140077BC5
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140077D41
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140077D54
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140077D5A

Strings

bad locale name, xrefs: 0000000140077D47
false, xrefs: 0000000140077C4D
true, xrefs: 0000000140077C7C

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 5e2f62486aa130fd71c29579b58b85236f09a81090f1fa47964e6339847e22c4
Instruction ID: 701d2af66d7bcb7f756f72429c8ce7358c648dd8aae16270157d1bad5a6b8e54
Opcode Fuzzy Hash: 5e2f62486aa130fd71c29579b58b85236f09a81090f1fa47964e6339847e22c4
Instruction Fuzzy Hash: 80712B32702B408AEB16DFB2D4507ED33B5EB88798F144529AF4D27BA9DB38C851D384

Function 0000000140087AD0 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140087B01
GetProcessId.KERNEL32 ref: 0000000140087B0A
RmStartSession.RSTRTMGR ref: 0000000140087B2A
RmRegisterResources.RSTRTMGR ref: 0000000140087B55
RmGetList.RSTRTMGR ref: 0000000140087B8E
RmGetList.RSTRTMGR ref: 0000000140087BF0
RmEndSession.RSTRTMGR ref: 0000000140087C2B
RmEndSession.RSTRTMGR ref: 0000000140087C62
RmEndSession.RSTRTMGR ref: 0000000140087C77

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: ac7f17f62b0b4b4372e261901ae0ae280e2f32aacd8c1b6a651c7a63f9ba0fb0
Instruction ID: 28406638ee9cc6da41cc4624a4130a8f60d872a6401ffb0c09cabb81deaaeebb
Opcode Fuzzy Hash: ac7f17f62b0b4b4372e261901ae0ae280e2f32aacd8c1b6a651c7a63f9ba0fb0
Instruction Fuzzy Hash: 8B510932B10A418AFB55CFA6E4947DD33B1B74CB98F50452AEF0A67BA8DE34C9468740

Function 0000000140078180 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00000001400781EB
InternetOpenUrlA.WININET ref: 0000000140078220
InternetReadFile.WININET ref: 0000000140078241
InternetReadFile.WININET ref: 000000014007827F
InternetCloseHandle.WININET ref: 000000014007828C
InternetCloseHandle.WININET ref: 0000000140078295

Strings

File Downloader, xrefs: 00000001400781E4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 91e744b22f357f91b51b56f9f413c7a71866174e8c47e92bf1781ef31d06db3a
Instruction ID: 90d3a2ab7d51d0cdcd3df93dc5df7e9f8b99376d845350d8a9bc3faa8987492b
Opcode Fuzzy Hash: 91e744b22f357f91b51b56f9f413c7a71866174e8c47e92bf1781ef31d06db3a
Instruction Fuzzy Hash: 7B316932215B8086EB228F62E8507AAB3A0F78DBC4F544015EF8903B69DF7CD495CB00

Function 00000001400976BC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400976FF
_invalid_parameter_noinfo.LIBCMT ref: 0000000140097AEC
_invalid_parameter_noinfo.LIBCMT ref: 0000000140097D88

Strings

p, xrefs: 00000001400977B1
p, xrefs: 0000000140097829
f, xrefs: 0000000140097821

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 093d919f1147db272b61982627151958ca4ffb93205a600ccd7777d4ff13d37c
Instruction ID: c1c4c09ce694c5d2761327feb1826c73f1d813aa51c33c80f732bf475579e23f
Opcode Fuzzy Hash: 093d919f1147db272b61982627151958ca4ffb93205a600ccd7777d4ff13d37c
Instruction Fuzzy Hash: 4512E373B0424286FB669B17E054BFE72A2F7887D4F944116F79A47AE8D738C980CB11

Function 00000001400B401C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400B404D
GetLastError.KERNEL32 ref: 00000001400B4059
CloseHandle.KERNEL32 ref: 00000001400B4071
CreateFileW.KERNEL32 ref: 00000001400B409C
WriteConsoleW.KERNEL32 ref: 00000001400B40BB

Strings

CONOUT$, xrefs: 00000001400B407D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: d64a5614ff09383aec324552889b53812a6c5a93abf77eb905263844d90bf464
Instruction ID: ea0791206cbf91a6e8439ee37bd1fc609610c885a54b90aede8aa9994041ef11
Opcode Fuzzy Hash: d64a5614ff09383aec324552889b53812a6c5a93abf77eb905263844d90bf464
Instruction Fuzzy Hash: 96118F31724F8086E7659B53F85479962A0F78CFE4F044324EB5A8B7B4CF78C9148740

Function 00000001400ED750 Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400ED7FD
MultiByteToWideChar.KERNEL32 ref: 00000001400ED899
MultiByteToWideChar.KERNEL32 ref: 00000001400ED942
MultiByteToWideChar.KERNEL32 ref: 00000001400ED96C
MultiByteToWideChar.KERNEL32 ref: 00000001400EDA14
CompareStringEx.KERNEL32 ref: 00000001400EDA61

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 176a05565e62c8670592abb49cd0693c637945750d6ec9abbebbc61fe7a852da
Instruction ID: f8dc130a36b9238a8c98b6cf5f48b53d05cefd83ac63ac51846f929f0bd0a5a9
Opcode Fuzzy Hash: 176a05565e62c8670592abb49cd0693c637945750d6ec9abbebbc61fe7a852da
Instruction Fuzzy Hash: E6A1C47230468086EB238F2295543ED77A1E789BF4F584623FB592B7E9DB38CD448381

Function 00000001400ED3F0 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400ED460
MultiByteToWideChar.KERNEL32 ref: 00000001400ED4FE
LCMapStringEx.KERNEL32 ref: 00000001400ED567
LCMapStringEx.KERNEL32 ref: 00000001400ED5B9
LCMapStringEx.KERNEL32 ref: 00000001400ED65E
WideCharToMultiByte.KERNEL32 ref: 00000001400ED6B8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: ab8cc68040f5ba096ca5233c2424b9e0e4952a4f01a22be492c17f84c5e0e459
Instruction ID: b0b4058c6c005813ab29b5c5182734f2aa4317f655c10f4edf4e0466c9761d1b
Opcode Fuzzy Hash: ab8cc68040f5ba096ca5233c2424b9e0e4952a4f01a22be492c17f84c5e0e459
Instruction Fuzzy Hash: 12819272201B4086EB268F26E5403A9B3E6F75CBF8F144226FB5957BE8DB7CC8458740

Function 00000001400ED110 Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000001400ED161
AcquireSRWLockExclusive.KERNEL32 ref: 00000001400ED180
AcquireSRWLockExclusive.KERNEL32 ref: 00000001400ED1A2
sys_get_time.LIBCPMT ref: 00000001400ED1BD
TryAcquireSRWLockExclusive.KERNEL32 ref: 00000001400ED1E3
TryAcquireSRWLockExclusive.KERNEL32 ref: 00000001400ED1FB

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: dcaa0c5ec967c3866615ac309e3086bf37bc4396709c5386fc2d1e26bec89594
Instruction ID: d35380ac5dc8c6621463c68b2a488e0c8509341e9202d4ac2650970b4d8ed9e5
Opcode Fuzzy Hash: dcaa0c5ec967c3866615ac309e3086bf37bc4396709c5386fc2d1e26bec89594
Instruction Fuzzy Hash: D4415432614645D6EB66CF22E4403997370F75CBE4F40401BEB59676B8DB38CD91C780

Function 00000001400A1380 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400A138F
FlsSetValue.KERNEL32(?,?,0000CBAD7C06F683,0000000140098599,?,?,?,?,00000001400A4C7A,?,?,00000000,00000001400B4FAB,?,?,?), ref: 00000001400A13C5
FlsSetValue.KERNEL32(?,?,0000CBAD7C06F683,0000000140098599,?,?,?,?,00000001400A4C7A,?,?,00000000,00000001400B4FAB,?,?,?), ref: 00000001400A13F2
FlsSetValue.KERNEL32(?,?,0000CBAD7C06F683,0000000140098599,?,?,?,?,00000001400A4C7A,?,?,00000000,00000001400B4FAB,?,?,?), ref: 00000001400A1403
FlsSetValue.KERNEL32(?,?,0000CBAD7C06F683,0000000140098599,?,?,?,?,00000001400A4C7A,?,?,00000000,00000001400B4FAB,?,?,?), ref: 00000001400A1414
SetLastError.KERNEL32 ref: 00000001400A142F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f315bff3f121eea92fc65e4934a9c656c21546a62fcc0216925396bebcce8a35
Instruction ID: 589880f42d6e3b6d5e3dcf7580364cbf26f938d9c4ad176dbbc61c74096d9fe3
Opcode Fuzzy Hash: f315bff3f121eea92fc65e4934a9c656c21546a62fcc0216925396bebcce8a35
Instruction Fuzzy Hash: 2C116D3530464046FE5BA7277A513ED62926BECBF0F441724BB3607AF6EE78D9C14A40

Function 0000000140030420 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014003047F

Part of subcall function 00000001400EB290: AreFileApisANSI.KERNEL32 ref: 00000001400EB2A2

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140030727
__std_exception_destroy.LIBVCRUNTIME ref: 00000001400307E1

Strings

: ", xrefs: 000000014003053A
", ", xrefs: 000000014003056D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 74d7844f55131847a703fbd90a8ba6027f62be89986e57d0b50788c347825722
Instruction ID: ee2730f375569ea9536a1d268bf39ffeb1a5b52c80ab16f876cc2c221760e07d
Opcode Fuzzy Hash: 74d7844f55131847a703fbd90a8ba6027f62be89986e57d0b50788c347825722
Instruction Fuzzy Hash: B5B18B72701B4496EB02EF66E0543EE6362E749BC8F508521EF9D17BAADF38C595C380

Function 00000001400A87EC Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400A882B
_set_statfp.LIBCMT ref: 00000001400A8849
_set_statfp.LIBCMT ref: 00000001400A8872
_set_statfp.LIBCMT ref: 00000001400A8AAE

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: de79d958c5e3054b789d6cb0fdc246bb5b82f6ff87867a0cfa586ea14b582efc
Instruction ID: f75e9698b90858b7000f8c857f1fdfbe0f7a947ceeb3b381e8e5b03dd2eb572e
Opcode Fuzzy Hash: de79d958c5e3054b789d6cb0fdc246bb5b82f6ff87867a0cfa586ea14b582efc
Instruction Fuzzy Hash: 6B819132614A4485F7779B36A4403EB66A1AB7D7D8F094302BF5A275F5DB38C5C18F01

Function 00000001400A1448 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000000140093867,?,?,00000000,0000000140093B02,?,?,?,?,?,0000000140093A8E), ref: 00000001400A1467
FlsSetValue.KERNEL32(?,?,?,0000000140093867,?,?,00000000,0000000140093B02,?,?,?,?,?,0000000140093A8E), ref: 00000001400A1486
FlsSetValue.KERNEL32(?,?,?,0000000140093867,?,?,00000000,0000000140093B02,?,?,?,?,?,0000000140093A8E), ref: 00000001400A14AE
FlsSetValue.KERNEL32(?,?,?,0000000140093867,?,?,00000000,0000000140093B02,?,?,?,?,?,0000000140093A8E), ref: 00000001400A14BF
FlsSetValue.KERNEL32(?,?,?,0000000140093867,?,?,00000000,0000000140093B02,?,?,?,?,?,0000000140093A8E), ref: 00000001400A14D0

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1676eb1c086681754cdec43adc27aa7b6a61153bc21780dab2384285e321c083
Instruction ID: 0d1ef1d4058e45247e02d5614188330cc88f54a1d94e9fb8f7f84647bfc843e4
Opcode Fuzzy Hash: 1676eb1c086681754cdec43adc27aa7b6a61153bc21780dab2384285e321c083
Instruction Fuzzy Hash: 63117F3030824046FE5AA72B79513ED52416BEC7F0F4843247B3907BF5DA78D4818A00

Function 0000000140049230 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400492A0
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400492E8
_Getcoll.LIBCPMT ref: 000000014004931C

Strings

bad locale name, xrefs: 0000000140049421

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 690bf735e7399d60d838da55b4c8d166a4d35f3dcf6eedc939510c8b10dd32ac
Instruction ID: 7d70c87e757b0fa505c6547906dbb7234286445db572b8037e8612e10e68fe19
Opcode Fuzzy Hash: 690bf735e7399d60d838da55b4c8d166a4d35f3dcf6eedc939510c8b10dd32ac
Instruction Fuzzy Hash: 54A18D72702B808AEB16DFB6E4503ED73A1EB48BD8F044535EB5917BA9DF38C4918384

Function 00000001400C9020 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400C925A

Strings

$, xrefs: 00000001400C93AF
tter, xrefs: 00000001400C93D6
/, xrefs: 00000001400C93B8

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: $$/$tter
API String ID: 118556049-4034128088
Opcode ID: 78c00dd2343c4f11d66d5c5a8f84a6190050909561aa590201907e06486b094a
Instruction ID: 043a6daec951feca855aaf8e55dd951ca405c676b8a7f27430206c03811a78e9
Opcode Fuzzy Hash: 78c00dd2343c4f11d66d5c5a8f84a6190050909561aa590201907e06486b094a
Instruction Fuzzy Hash: EAB18F32618B9082E71ADF26E45439E73A0F799B84F149225FB9D43BE6DF78C591C340

Function 00000001400CA5C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400CA84A

Strings

iret, xrefs: 00000001400CA736
jmp, xrefs: 00000001400CA6BD
ret, xrefs: 00000001400CA6EC

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: iret$jmp$ret
API String ID: 118556049-3663989749
Opcode ID: a3ddfff3d57903b926266a725c83dcae5500f0ea628cc39230c9ba974c70b7e8
Instruction ID: 9dbf275b824d1b947d100a9cd47e19668fc538a858266b684bc1b9d38e714345
Opcode Fuzzy Hash: a3ddfff3d57903b926266a725c83dcae5500f0ea628cc39230c9ba974c70b7e8
Instruction Fuzzy Hash: 2F61C43271978046FE6A9B67D4143EE67A1A70EBE8F580622FB5907AF5DE3CC5458300

Function 000000014005CAB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014005CC90
__std_exception_destroy.LIBVCRUNTIME ref: 000000014005CC9D

Strings

at line , xrefs: 000000014005CB3A
, column , xrefs: 000000014005CB68

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 8dba13a9a80ced850344c879b1b2226b8032c608e6863bdd2bc3075708b848a0
Instruction ID: 7031134a4408c9c42c10040fe47d728b4c74b78f3ad1249b2c54a84e7865d3d6
Opcode Fuzzy Hash: 8dba13a9a80ced850344c879b1b2226b8032c608e6863bdd2bc3075708b848a0
Instruction Fuzzy Hash: 7F51D172614B8085EB12DF1AE1803AEA761F789BD4F504221FBAD07BEADF79C591C740

Function 000000014002F1A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002F20F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002F257
_Getctype.LIBCPMT ref: 000000014002F295

Strings

bad locale name, xrefs: 000000014002F34E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 1763c024eb5b742d8ced8bd84fdc3f51cddb39d11d8dbe72da030ec23196f5f2
Instruction ID: ed9f016bab2737485dd22282eb0ad0cc2fc6c37be771dd4a7ceb70f1b973fee3
Opcode Fuzzy Hash: 1763c024eb5b742d8ced8bd84fdc3f51cddb39d11d8dbe72da030ec23196f5f2
Instruction Fuzzy Hash: D5510936706B408AFB16DF62E4903ED33B5AB58788F044439AF4927AA9DF34C9569384

Function 00000001400845A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014008462B

Strings

?, xrefs: 00000001400845E0

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: a50af8b6cdcf3ae12692b308cee929ad0a2bc63e8b0f89dba0763a4110380345
Instruction ID: e61a056147e077ec949efbf7d89381559ee98871a0b520f2cde917a45fcecb2c
Opcode Fuzzy Hash: a50af8b6cdcf3ae12692b308cee929ad0a2bc63e8b0f89dba0763a4110380345
Instruction Fuzzy Hash: D9419E72618B8482EB51CB26F4803AEB3A0F79D7D4F105216FB9943BA9DF38C194CB40

Function 00000001400EB240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400EB256
GetProcAddress.KERNEL32 ref: 00000001400EB266

Strings

kernel32.dll, xrefs: 00000001400EB24F
GetTempPath2W, xrefs: 00000001400EB25C

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 1486a03457541e07cc672fa27f6337fb1d4ca800d066eee7c0edc0d6007ce8ef
Instruction ID: d7bb11a90144fd5cf7fc28a71200a72d31e23ad76614fc0747e7f00bef6df8f4
Opcode Fuzzy Hash: 1486a03457541e07cc672fa27f6337fb1d4ca800d066eee7c0edc0d6007ce8ef
Instruction Fuzzy Hash: 83E0E531310A4492EE0A9B56F9843A92321BB8CF85F585025DA1E0B334EE3CC4A98700

Function 00000001400C85D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001400C85DB
GetProcAddress.KERNEL32 ref: 00000001400C85F5

Strings

VirtualAlloc2, xrefs: 00000001400C85EB
kernelbase.dll, xrefs: 00000001400C85D4

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 2574300362-1188699709
Opcode ID: 05473327a1975c6075b06088ed585200b6a11a07f1b9b7cf8b29158ac04d1699
Instruction ID: c83c56272493cef265f0a675233120f8c7a0f1a7ed25361d1b6ccd5347dc0b2b
Opcode Fuzzy Hash: 05473327a1975c6075b06088ed585200b6a11a07f1b9b7cf8b29158ac04d1699
Instruction Fuzzy Hash: E1D09EB4B02A00D1FD0F9B139C857D43390A75CF55FC91419DB0D063B0EA3CC5A99700

Function 0000000140072380 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071C30: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140071C86
Part of subcall function 0000000140071C30: Process32FirstW.KERNEL32 ref: 0000000140071CCA
Part of subcall function 0000000140071C30: Process32NextW.KERNEL32 ref: 0000000140071CDF
Part of subcall function 0000000140071C30: OpenProcess.KERNEL32 ref: 0000000140071D1B
Part of subcall function 0000000140071C30: OpenProcessToken.ADVAPI32 ref: 0000000140071D42
Part of subcall function 0000000140071C30: CloseHandle.KERNEL32 ref: 0000000140071EB6
Part of subcall function 0000000140071C30: Process32NextW.KERNEL32 ref: 0000000140071EC3
Part of subcall function 0000000140071C30: CloseHandle.KERNEL32 ref: 0000000140071F07

ImpersonateLoggedOnUser.ADVAPI32 ref: 00000001400723DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 00000001400728C8
RevertToSelf.ADVAPI32 ref: 00000001400728E6

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: 7d415029b2757a2081211a74c09c5e4cf0b35ebb6a139fa993b17479d8854a42
Instruction ID: 7c0ca58a9aec7d0c2e441d27954bfe428e32970f8856dc50ac318500c69ad614
Opcode Fuzzy Hash: 7d415029b2757a2081211a74c09c5e4cf0b35ebb6a139fa993b17479d8854a42
Instruction Fuzzy Hash: FA228A72B14B8486FB12DB6AD4443EE6761E7897E8F505211FBAD07AFADB78C480D700

Function 00000001400A3AF8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000001400A3B77
WriteFile.KERNEL32 ref: 00000001400A3E3F
WriteFile.KERNEL32 ref: 00000001400A3E85
GetLastError.KERNEL32 ref: 00000001400A3F3B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: fa227f40509e3349170f30eb00e800148d5492ae5e34f4221cfa920054858855
Instruction ID: cc76d7eb8d2524bbe1888cff94a76c230707d05ca95a0238572eabb795a4cbd8
Opcode Fuzzy Hash: fa227f40509e3349170f30eb00e800148d5492ae5e34f4221cfa920054858855
Instruction Fuzzy Hash: BBD1BD72B14A808AE712CF76D4403DC3BB5F368BD8F144216EF5A97BA9DA34C556CB40

Function 00000001400A44B8 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000001400A45D4
GetLastError.KERNEL32 ref: 00000001400A465F

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ea0dbdd26401f5cb4a0c0125367f5e5ac445343ac2477cca2c429100b6a00301
Instruction ID: b089ba5d81ae15676850509c443ca630367b947a126341115506d28bc8679957
Opcode Fuzzy Hash: ea0dbdd26401f5cb4a0c0125367f5e5ac445343ac2477cca2c429100b6a00301
Instruction Fuzzy Hash: 1391B276710A9089F762DF7694807ED2BA4B3ADBC8F544219EF0A57EA5DB34C4C2CB01

Function 00000001400881C0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000001400881E0
FreeEnvironmentStringsW.KERNEL32 ref: 00000001400882DB
RtlInitUnicodeString.NTDLL ref: 000000014008834E
RtlInitUnicodeString.NTDLL ref: 000000014008835B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 9998ce77c7cdb27e102225a7ea8e8f1a05c1c5a489cd69ea45e5b7b0992b5763
Instruction ID: d066331094e37f5ad47153384aa794f9905475e0228902f3b3865b28cca38b25
Opcode Fuzzy Hash: 9998ce77c7cdb27e102225a7ea8e8f1a05c1c5a489cd69ea45e5b7b0992b5763
Instruction Fuzzy Hash: A9518B32A08B84C2EB269F16E44039D7360F799BD4F549211EF9903BA5DF78D6E1C704

Function 00000001400429B0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400EC61C: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400EC639
Part of subcall function 00000001400EC61C: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400EC65C

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400429F1
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140042A16
std::_Facet_Register.LIBCPMT ref: 0000000140042AC2
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140042B24

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 46e8ebc10cef859a03b016e4fcb79cade8fbd252c9fdab980bf149d09f806ef6
Instruction ID: a868246b6eac79998667ca408589b0e1d89fbb430c517a9ec13aa9d8bb030ba8
Opcode Fuzzy Hash: 46e8ebc10cef859a03b016e4fcb79cade8fbd252c9fdab980bf149d09f806ef6
Instruction Fuzzy Hash: 2A515A32214A8082EA66DB16E8807DE73A4F78CBE4F995521FF9D077A5DF38C852C744

Function 0000000140056710 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014005673B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140056760
std::_Facet_Register.LIBCPMT ref: 000000014005680B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140056856

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 8eabdd226202b69a5b07989a41ada8883cb072f3a80f5271708cb34f4b490cd8
Instruction ID: e119a2a33a1cef20ded635f5491062fe76567ec2ab29b9084768f9e63a09518a
Opcode Fuzzy Hash: 8eabdd226202b69a5b07989a41ada8883cb072f3a80f5271708cb34f4b490cd8
Instruction Fuzzy Hash: A9418F36214A4481EA16DB27E8503EA77A0F78CBE8F580625FB5D477B5DF39C842C780

Function 00000001400777E0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007780B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140077830
std::_Facet_Register.LIBCPMT ref: 00000001400778DB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140077926

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 2d32961d9834393a9a4649f57c5d2f962ae39a96efb2959bd8c44ab6f7acdf52
Instruction ID: a51bf53b5ea322372e50b385ebfde117cd8d917b5fa8b8cb9fba4adeeb1b93d5
Opcode Fuzzy Hash: 2d32961d9834393a9a4649f57c5d2f962ae39a96efb2959bd8c44ab6f7acdf52
Instruction Fuzzy Hash: 8E416B32250B8080EB569B17E884BDA6760F78CBE4F585122FB8D47BB9DE38C842C741

Function 0000000140044BC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140044BEB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140044C10
std::_Facet_Register.LIBCPMT ref: 0000000140044CBB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140044D06

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: d97067b01ae72d56d3a67cf2b4b141078492a953b35c66c447eaf66f69042bf1
Instruction ID: 6addc39f3419bfd51fecd1b075df3fe74efa98199824f0b04fd02c7d6470b276
Opcode Fuzzy Hash: d97067b01ae72d56d3a67cf2b4b141078492a953b35c66c447eaf66f69042bf1
Instruction Fuzzy Hash: C2413B36215A4081EB66DB17E4807EA6760F78CFE8F590521FB8D477B9DE38C842C744

Function 00000001400A0354 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00000001400A03AB
GetSystemInfo.KERNEL32 ref: 00000001400A03C4
VirtualAlloc.KERNEL32 ref: 00000001400A0432
VirtualProtect.KERNEL32 ref: 00000001400A044D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 8a2bbf003fd111d706c6fd64fcd7f6bc576560aafa18823378a93e99d6bad30c
Instruction ID: 45141b9b6b1e59eceaaef1c0ea755389835b22969996e25d1d7ff71a4f5fd6d7
Opcode Fuzzy Hash: 8a2bbf003fd111d706c6fd64fcd7f6bc576560aafa18823378a93e99d6bad30c
Instruction Fuzzy Hash: C4312432310A849EEB25CF22D8947D863A5F74CB88F944126EB4D4BB68DF38D686C740

Function 00000001400C84E0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00000001400C8513
VirtualQuery.KERNEL32 ref: 00000001400C8530
VirtualAlloc.KERNEL32 ref: 00000001400C857D
GetLastError.KERNEL32 ref: 00000001400C8588

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Virtual$AllocErrorInfoLastQuerySystem
String ID:
API String ID: 1049033158-0
Opcode ID: d872fbe448948c767ec3bc1a116c0b4bd5007c960505a89269850af99479ab08
Instruction ID: 718e04c13ae720965a58afc9ef70e057d3f831b8443eac539be970966a2a8592
Opcode Fuzzy Hash: d872fbe448948c767ec3bc1a116c0b4bd5007c960505a89269850af99479ab08
Instruction Fuzzy Hash: D7216D36719B4086FA2ACB12E9443A9A361BB9CFD0F184221EF4907B64DEB8C9918704

Function 00000001400EB424 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400EB46D
GetLastError.KERNEL32 ref: 00000001400EB47B
WideCharToMultiByte.KERNEL32 ref: 00000001400EB4B0
GetLastError.KERNEL32 ref: 00000001400EB4BE

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: ff24e7c81d8dd03fcc82aaf7c0397415c41f33d4ac3d30ba58ee66f2e510de4b
Instruction ID: 71a9b5c1710e2883f59aa1d7230d880a1386000bb386aa6b37c2d3d18c5d1734
Opcode Fuzzy Hash: ff24e7c81d8dd03fcc82aaf7c0397415c41f33d4ac3d30ba58ee66f2e510de4b
Instruction Fuzzy Hash: D8215E76614B8487E314CF22E44435EBAB4F78CFD4F240128EB8957BA5DB38C8118B40

Function 00000001400EB910 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400EB240: GetModuleHandleW.KERNEL32 ref: 00000001400EB256
Part of subcall function 00000001400EB240: GetProcAddress.KERNEL32 ref: 00000001400EB266

GetLastError.KERNEL32 ref: 00000001400EB934

Part of subcall function 00000001400A0BD0: IsProcessorFeaturePresent.KERNEL32 ref: 00000001400A0BF6

GetFileAttributesW.KERNEL32 ref: 00000001400EB943
__std_fs_open_handle.LIBCPMT ref: 00000001400EB96C
CloseHandle.KERNEL32 ref: 00000001400EB97E

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ff84833c07db3a440c65d57b8044d8f8c966896eddfc2047d037f3ea1e07a621
Instruction ID: 472da5b09a9cb56795d551bb6a50458ca4e3446e7159e652faf71c9dc470d0dd
Opcode Fuzzy Hash: ff84833c07db3a440c65d57b8044d8f8c966896eddfc2047d037f3ea1e07a621
Instruction Fuzzy Hash: AE11863121864085E7969B67A5C43BB6661D78C7F0F101614FBB75BAF6DA38C8418B40

Function 00007FF6C0A0FDE4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6C0A0FE10
GetCurrentThreadId.KERNEL32 ref: 00007FF6C0A0FE1E
GetCurrentProcessId.KERNEL32 ref: 00007FF6C0A0FE2A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6C0A0FE3A

Memory Dump Source

Source File: 00000001.00000002.1944424226.00007FF6C09C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C09C0000, based on PE: true

Associated: 00000001.00000002.1944404356.00007FF6C09C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944470132.00007FF6C0A3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944470132.00007FF6C0A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944470132.00007FF6C0DAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944718370.00007FF6C0DC7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944743666.00007FF6C0DCB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944743666.00007FF6C0DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1944784977.00007FF6C0DD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c09c0000_unturnedHack.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 66dffe7ee173be83caf6d25513cd58fc43f63803bf13eaf2a3b2507e135e52d1
Instruction ID: 4b8f8af99a0a36e3e57aea45d3c1741a607fdf6e0a13b17ca14abc6b298be07a
Opcode Fuzzy Hash: 66dffe7ee173be83caf6d25513cd58fc43f63803bf13eaf2a3b2507e135e52d1
Instruction Fuzzy Hash: AA112A22B14F069AEB00DF60E8542B833A4FB59759F441E31DAADC67A4DF7CE1548380

Function 00000001400B7058 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400B7084
GetCurrentThreadId.KERNEL32 ref: 00000001400B7092
GetCurrentProcessId.KERNEL32 ref: 00000001400B709E
QueryPerformanceCounter.KERNEL32 ref: 00000001400B70AE

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 066ada9d6ce2bb7bf232f60978bcef186f182671c9b57ade480c1311d2a17256
Instruction ID: 90c76ba50da2ad878d61ac5e7db2854dd99c63fcc23ed93af3ff9b25eb5d75e6
Opcode Fuzzy Hash: 066ada9d6ce2bb7bf232f60978bcef186f182671c9b57ade480c1311d2a17256
Instruction Fuzzy Hash: 4A11FA36711F048AEB01DF62E8553A833A4F75DB68F441E25EB6D477A4DF78C5A48380

Function 0000000140031330 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000000014003146B

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 21217cc1dccd80094001e5f4495b3052dcfda711832bb23409bb31d897a3b76d
Instruction ID: 0a3b62a320f7775fde10ec9ecb6b401eda8d66685c06b0f12b4726be1f72e163
Opcode Fuzzy Hash: 21217cc1dccd80094001e5f4495b3052dcfda711832bb23409bb31d897a3b76d
Instruction Fuzzy Hash: 9A71CF72B10B9085F702CF7AE4403DD67A1E799BD8F544226EF9917BAADB78C1918340

Function 0000000140057440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400574AF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400574F7

Strings

bad locale name, xrefs: 00000001400575D6

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: fa9df1d48b5431f81d07dd4cb73616de3ee709b972c75d787142681fc01b4e6e
Instruction ID: a37e4edce99f6697df828f979023ba2b2dafc72c7dc620fb229006b8ce9a2efe
Opcode Fuzzy Hash: fa9df1d48b5431f81d07dd4cb73616de3ee709b972c75d787142681fc01b4e6e
Instruction Fuzzy Hash: 07513B32302A4089EB16DF72E4907EC33B4EB48788F044439FB4967AA9DF35C555D348

Function 00000001400AA4A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400AF884: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AF8B7

_get_daylight.LIBCMT ref: 00000001400AA5BC
_get_daylight.LIBCMT ref: 00000001400AA5CD

Strings

?, xrefs: 00000001400AA54D

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 178c9834567cdffd03bac7faf45fa38e90026ec5dba761da37376aa49044c63e
Instruction ID: 4480cc6cf0104bc5aa872edda86c4c6760ef52ecb92ba8a55af73ae2f566c83b
Opcode Fuzzy Hash: 178c9834567cdffd03bac7faf45fa38e90026ec5dba761da37376aa49044c63e
Instruction Fuzzy Hash: 3941B23260468056FB669B67E4513EA66A0E7AABE4F144325BF5907AF5DB3CC4C1CF00

Function 00000001400A4190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000001400A42A7
GetLastError.KERNEL32 ref: 00000001400A42C9

Strings

U, xrefs: 00000001400A4253

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1a35e0ff9681dd9ffee4af38256a35880782598a07eb70b704dcc49749e705a6
Instruction ID: 260454151d0eefe5de768069f8204a5fcfa5de7daab306c2adc423a13909cb48
Opcode Fuzzy Hash: 1a35e0ff9681dd9ffee4af38256a35880782598a07eb70b704dcc49749e705a6
Instruction Fuzzy Hash: AD418032615A4086DB519F66E4443EA67A0F39CBD4F854121FF4D87BA8DB7CC441CB40

Function 00000001400B85D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400B8628
RaiseException.KERNEL32 ref: 00000001400B8669

Strings

csm, xrefs: 00000001400B8656

Memory Dump Source

Source File: 00000001.00000002.1943060514.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_unturnedHack.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: aef85c17f5724204ad0c80a571103dcf5f2f2ffa9173f2d18470242902e0a6db
Instruction ID: 2598e16f07b8f2632418390bdced9d3dc66b3cf32376aa5b185504ec6e669405
Opcode Fuzzy Hash: aef85c17f5724204ad0c80a571103dcf5f2f2ffa9173f2d18470242902e0a6db
Instruction Fuzzy Hash: D511B632215B8082EB668F16E44439AB7E5F79CB98F584225EF8D07B69EF39C551CB00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report unturnedHack.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
unturnedHack.exe

Function 00000001400831C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 227
windowCOMMON

Function 00000001400EB5E0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 000000014003E240 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 00000001400C3180 Relevance: 19.8, Strings: 15, Instructions: 1071
COMMON

Function 00000001400796D0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 416
synchronizationCOMMON

Function 00000001400AA588 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 0000000140082890 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 00000001400F2268 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 000000014005D2B0 Relevance: 13.6, APIs: 1, Strings: 6, Instructions: 1378
COMMON

Function 000000014007C5E0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 00000001400C83D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Function 00000001400AA804 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre